DragonFlyBSD Kernel Audit
DF-2518 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/sili/sili.c b/sys/dev/disk/sili/sili.c
--- a/sys/dev/disk/sili/sili.c
+++ b/sys/dev/disk/sili/sili.c
@@ -2137,6 +2137,11 @@
 			 */
 			err_slot = log->err_regs.type &
 				   ATA_LOG_10H_TYPE_TAG_MASK;
+			if (err_slot >= sc->sc_ncmds) {
+				kprintf("%s: NCQ error page has invalid tag %d\n",
+				    PORTNAME(ap), err_slot);
+				break;
+			}
 			ccb = &ap->ap_ccbs[err_slot];
 			if (ap->ap_expired & (1 << ccb->ccb_slot)) {
 				kprintf("%s: read NCQ error page slot=%d\n",