DF-3732 / fix.diff
--- a/sys/dev/raid/ciss/ciss.c +++ b/sys/dev/raid/ciss/ciss.c @@ -689,9 +689,15 @@ } setup: if ((supported_methods & CISS_TRANSPORT_METHOD_PERF) != 0) { - method = CISS_TRANSPORT_METHOD_PERF; + method = CISS_TRANSPORT_METHOD_PERF; + if (cofs + sc->ciss_cfg->transport_offset + + sizeof(struct ciss_perf_config) > csize) { + ciss_printf(sc, "performant transport table outside window\n"); + supported_methods &= ~CISS_TRANSPORT_METHOD_PERF; + goto setup; + } sc->ciss_perf = (struct ciss_perf_config *)(cbase + cofs + sc->ciss_cfg->transport_offset); if (ciss_init_perf(sc)) { supported_methods &= ~method; |