⬢ DragonFlyBSD Kernel Audit
DF-3815 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/raid/mpr/mpr.c
+++ b/sys/dev/raid/mpr/mpr.c
@@ -396,7 +396,10 @@
 	 */
 	if (sc->facts->MsgVersion >= MPI2_VERSION_02_05) {
 		chain_seg_size = htole16(sc->facts->IOCMaxChainSegmentSize);
-		if (chain_seg_size == 0)
+		if (chain_seg_size < 2)
+			/* 0 means "use default"; 1 would make
+			 * sges_per_frame below zero-input and divide by
+			 * zero in the num_chains calculation. */
 			chain_seg_size = MPR_DEFAULT_CHAIN_SEG_SIZE;
 		sc->chain_frame_size = chain_seg_size *
 		    MPR_MAX_CHAIN_ELEMENT_SIZE;