⬢ DragonFlyBSD Kernel Audit
DF-3675 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
--- a/sys/dev/disk/mpt/mpt_cam.c
+++ b/sys/dev/disk/mpt/mpt_cam.c
@@ -3129,8 +3129,14 @@ mpt_scsi_reply_frame_handler(struct mpt_softc *mpt, request_t *req,
 	sstate = scsi_io_reply->SCSIState;
 
 	ccb = req->ccb;
-	ccb->csio.resid =
-	    ccb->csio.dxfer_len - le32toh(scsi_io_reply->TransferCount);
+	{
+		uint32_t xferred = le32toh(scsi_io_reply->TransferCount);
+
+		if (xferred > ccb->csio.dxfer_len)
+			ccb->csio.resid = 0;	/* IOC over-reported */
+		else
+			ccb->csio.resid = ccb->csio.dxfer_len - xferred;
+	}
 
 	if ((sstate & MPI_SCSI_STATE_AUTOSENSE_VALID) != 0
 	 && (ccb->ccb_h.flags & (CAM_SENSE_PHYS | CAM_SENSE_PTR)) == 0) {