⬢ DragonFlyBSD Kernel Audit
DF-4085 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/raid/mps/mps_mapping.c
+++ b/sys/dev/raid/mps/mps_mapping.c
@@ -1522,6 +1528,14 @@
 				    MPI2_DRVMAP0_MAPINFO_SLOT_MASK;
 				num_slots >>= MPI2_DRVMAP0_MAPINFO_SLOT_SHIFT;
 			}
+			if ((dev_idx >= sc->max_devices) ||
+				(num_slots > (sc->max_devices - dev_idx))) {
+				kprintf("%s: DPM entry %d dev_idx %d num_slots %d "
+					"exceeds mapping table size %d; skipping entry\n",
+					__func__, entry_num, dev_idx, num_slots,
+					sc->max_devices);
+				continue;
+			}
 			enc_idx = sc->num_enc_table_entries;
 			if (enc_idx >= sc->max_enclosures) {
 				kprintf("%s: enclosure entries exceed max "