⬢ DragonFlyBSD Kernel Audit
DF-3658 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
--- a/sys/dev/disk/isp/isp_freebsd.c
+++ b/sys/dev/disk/isp/isp_freebsd.c
@@ -4563,6 +4563,11 @@ isp_action(struct cam_sim *sim, union ccb *ccb)
 		}
 		tgt = cts->ccb_h.target_id;
 		bus = cam_sim_bus(xpt_path_sim(cts->ccb_h.path));
+		if (tgt >= ISP_MAX_TARGETS(isp)) {
+			ccb->ccb_h.status = CAM_TID_INVALID;
+			xpt_done(ccb);
+			break;
+		}
 		if (IS_SCSI(isp)) {
 			struct ccb_trans_settings_scsi *scsi = &cts->proto_specific.scsi;
 			struct ccb_trans_settings_spi *spi = &cts->xport_specific.spi;
@@ -4628,6 +4633,11 @@ isp_action(struct cam_sim *sim, union ccb *ccb)
 	case XPT_GET_TRAN_SETTINGS:
 		cts = &ccb->cts;
 		tgt = cts->ccb_h.target_id;
 		bus = cam_sim_bus(xpt_path_sim(cts->ccb_h.path));
+		if (tgt >= ISP_MAX_TARGETS(isp)) {
+			ccb->ccb_h.status = CAM_TID_INVALID;
+			xpt_done(ccb);
+			break;
+		}
 		if (IS_FC(isp)) {
 			fcparam *fcp = FCPARAM(isp, bus);
 			struct ccb_trans_settings_scsi *scsi = &cts->proto_specific.scsi;