--- a/sys/dev/disk/isp/isp.c +++ b/sys/dev/disk/isp/isp.c @@ -4519,6 +4519,12 @@ isp_control(ispsoftc_t *isp, ispctl_t ctl, ...) fcparam *fcp = FCPARAM(isp, chan); fcportdb_t *lp; int hdlidx; + if (tgt < 0 || tgt >= MAX_FC_TARG) { + isp_prt(isp, ISP_LOGWARN, + "Chan %d bad target %d trying to reset", + chan, tgt); + break; + } hdlidx = fcp->isp_dev_map[tgt] - 1; if (hdlidx < 0 || hdlidx >= MAX_FC_TARG) { isp_prt(isp, ISP_LOGWARN, @@ -4621,6 +4627,12 @@ isp_control(ispsoftc_t *isp, ispctl_t ctl, ...) fcparam *fcp; fcportdb_t *lp; int hdlidx; + if (tgt < 0 || tgt >= MAX_FC_TARG) { + isp_prt(isp, ISP_LOGWARN, + "Chan %d bad target %d trying to abort", + chan, tgt); + break; + } fcp = FCPARAM(isp, chan); hdlidx = fcp->isp_dev_map[tgt] - 1; if (hdlidx < 0 || hdlidx >= MAX_FC_TARG) {