⬢ DragonFlyBSD Kernel Audit
DF-4174 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/raid/iir/iir.c
+++ b/sys/dev/raid/iir/iir.c
@@ -733,6 +733,14 @@
             ccbh->status = CAM_REQ_INVALID;
             --gdt_stat.io_count_act;
             xpt_done(ccb);
+        } else if ((ccbh->flags & CAM_SCATTER_VALID) &&
+                   csio->sglist_cnt > GDT_MAXSG) {
+            /* physical S/G lists are copied verbatim into the fixed
+               GDT_MAXSG-entry array in gccb->gc_cmd -- an oversized
+               list overflows it */
+            ccbh->status = CAM_REQ_TOO_BIG;
+            --gdt_stat.io_count_act;
+            xpt_done(ccb);
         } else if (bus != gdt->sc_virt_bus) {
             /* raw service command */
             if ((gccb = gdt_raw_cmd(gdt, ccb)) == NULL) {