⬢ DragonFlyBSD Kernel Audit
DF-3732 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/raid/ciss/ciss.c
+++ b/sys/dev/raid/ciss/ciss.c
@@ -689,9 +689,15 @@
     }
 
 setup:
     if ((supported_methods & CISS_TRANSPORT_METHOD_PERF) != 0) {
-	method = CISS_TRANSPORT_METHOD_PERF;
+	method = CISS_TRANSPORT_METHOD_PERF;
+	if (cofs + sc->ciss_cfg->transport_offset +
+	    sizeof(struct ciss_perf_config) > csize) {
+	    ciss_printf(sc, "performant transport table outside window\n");
+	    supported_methods &= ~CISS_TRANSPORT_METHOD_PERF;
+	    goto setup;
+	}
 	sc->ciss_perf = (struct ciss_perf_config *)(cbase + cofs +
 	    sc->ciss_cfg->transport_offset);
 	if (ciss_init_perf(sc)) {
 	    supported_methods &= ~method;