⬢ DragonFlyBSD Kernel Audit
DF-3929 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
--- a/sys/dev/raid/mly/mly.c
+++ b/sys/dev/raid/mly/mly.c
@@ -1532,7 +1532,8 @@ mly_done(struct mly_softc *sc) 
     /* pick up hardware-mailbox commands */
     if (MLY_ODBR_TRUE(sc, MLY_HM_STSREADY)) {
 	slot = MLY_GET_REG2(sc, sc->mly_status_mailbox);
-	if (slot < MLY_SLOT_MAX) {
+	if (slot >= MLY_SLOT_START && slot < MLY_SLOT_MAX) {
 	    mc = &sc->mly_command[slot - MLY_SLOT_START];
 	    mc->mc_status = MLY_GET_REG(sc, sc->mly_status_mailbox + 2);
 	    mc->mc_sense = MLY_GET_REG(sc, sc->mly_status_mailbox + 3);
@@ -1561,7 +1562,8 @@ mly_done(struct mly_softc *sc) 
 	    /* get slot number */
 	    slot = sp->status.command_id;
-	    if (slot < MLY_SLOT_MAX) {
+	    if (slot >= MLY_SLOT_START && slot < MLY_SLOT_MAX) {
 		mc = &sc->mly_command[slot - MLY_SLOT_START];
 		mc->mc_status = sp->status.status;
 		mc->mc_sense = sp->status.sense_length;