⬢ DragonFlyBSD Kernel Audit
DF-4387 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
--- a/sys/dev/netif/oce/oce_sysctl.c
+++ b/sys/dev/netif/oce/oce_sysctl.c
@@ -1148,6 +1148,9 @@
 	nic_mbx = OCE_DMAPTR(&sc->stats_mem, struct mbx_get_nic_stats_v0);
 	pmem = &nic_mbx->params.rsp.stats.pmem;
 	rxf_stats = &nic_mbx->params.rsp.stats.rxf;
+	/* port_id is device-supplied and unvalidated */
+	if (port >= NELEM(nic_mbx->params.rsp.stats.rxf.port))
+		port = 0;
 	port_stats = &nic_mbx->params.rsp.stats.rxf.port[port];
 
 	adapter_stats = &sc->oce_stats_info.u0.be;
@@ -1213,6 +1216,9 @@
 	nic_mbx = OCE_DMAPTR(&sc->stats_mem, struct mbx_get_nic_stats);
 	pmem = &nic_mbx->params.rsp.stats.pmem;
 	rxf_stats = &nic_mbx->params.rsp.stats.rxf;
+	/* port_id is device-supplied and unvalidated */
+	if (port >= NELEM(nic_mbx->params.rsp.stats.rxf.port))
+		port = 0;
 	port_stats = &nic_mbx->params.rsp.stats.rxf.port[port];
 
 	adapter_stats = &sc->oce_stats_info.u0.be;