⬢ DragonFlyBSD Kernel Audit
DF-3584 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
--- a/sys/dev/disk/isp/isp.c
+++ b/sys/dev/disk/isp/isp.c
@@ -4519,6 +4519,12 @@ isp_control(ispsoftc_t *isp, ispctl_t ctl, ...)
 			fcparam *fcp = FCPARAM(isp, chan);
 			fcportdb_t *lp;
 			int hdlidx;
 
+			if (tgt < 0 || tgt >= MAX_FC_TARG) {
+				isp_prt(isp, ISP_LOGWARN,
+				    "Chan %d bad target %d trying to reset",
+				    chan, tgt);
+				break;
+			}
 			hdlidx = fcp->isp_dev_map[tgt] - 1;
 			if (hdlidx < 0 || hdlidx >= MAX_FC_TARG) {
 				isp_prt(isp, ISP_LOGWARN,
@@ -4621,6 +4627,12 @@ isp_control(ispsoftc_t *isp, ispctl_t ctl, ...)
 			fcparam *fcp;
 			fcportdb_t *lp;
 			int hdlidx;
 
+			if (tgt < 0 || tgt >= MAX_FC_TARG) {
+				isp_prt(isp, ISP_LOGWARN,
+				    "Chan %d bad target %d trying to abort",
+				    chan, tgt);
+				break;
+			}
 			fcp = FCPARAM(isp, chan);
 			hdlidx = fcp->isp_dev_map[tgt] - 1;
 			if (hdlidx < 0 || hdlidx >= MAX_FC_TARG) {