⬢ DragonFlyBSD Kernel Audit
DF-4557 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
--- a/sys/dev/disk/nata/atapi-cam.c	2026-09-21 13:15:11.155028752 +0000
+++ b/sys/dev/disk/nata/atapi-cam.c	2026-09-21 13:16:00.246393469 +0000
@@ -358,6 +358,13 @@
 	struct ccb_pathinq *cpi = &ccb->cpi;
 	int tid = ccb_h->target_id;
 
+	if (tid != CAM_TARGET_WILDCARD &&
+	    tid >= (int)NELEM(softc->atadev)) {
+	    ccb->ccb_h.status = CAM_DEV_NOT_THERE;
+	    xpt_done(ccb);
+	    return;
+	}
+
 	cpi->version_num = 1;
 	cpi->hba_inquiry = 0;
 	cpi->target_sprt = 0;
@@ -428,6 +435,11 @@
     case XPT_RESET_DEV: {
 	int tid = ccb_h->target_id;
 
+	if (tid < 0 || tid >= (int)NELEM(softc->atadev)) {
+	    ccb->ccb_h.status = CAM_DEV_NOT_THERE;
+	    xpt_done(ccb);
+	    return;
+	}
 	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_SUBTRACE, ("dev reset\n"));
 	ata_controlcmd(softc->atadev[tid]->dev, ATA_DEVICE_RESET, 0, 0, 0);
 	ccb->ccb_h.status = CAM_REQ_CMP;
@@ -477,6 +489,14 @@
 	int tid = ccb_h->target_id, lid = ccb_h->target_lun;
 	int request_flags = ATA_R_QUIET | ATA_R_ATAPI;
 
+	/* ccb_h->target_id is not bounded by this SIM's max_target:
+	 * reject out-of-range ids before indexing atadev[]. */
+	if (tid < 0 || tid >= (int)NELEM(softc->atadev)) {
+	    ccb->ccb_h.status = CAM_DEV_NOT_THERE;
+	    xpt_done(ccb);
+	    return;
+	}
+
 	CAM_DEBUG(ccb_h->path, CAM_DEBUG_SUBTRACE, ("XPT_SCSI_IO\n"));
 
 	lockmgr(&softc->state_lock, LK_EXCLUSIVE);