⬢ DragonFlyBSD Kernel Audit
DF-4561 / fix.diff
← back to finding ↓ download raw
fix.diff — DF-4561: mpssas_ir_shutdown skips the last IR volume slot.

end_idx = start_idx + max_volumes - 1 is the LAST slot of the IR map range
(same formula as _mapping_get_ir_maprange, mps_mapping.c:234, whose consumers
scan inclusively: `map_idx <= end_idx`, mps_mapping.c:366).  The shutdown
scan uses `id < end_idx` and therefore checks only max_volumes-1 slots: a
volume mapped into the final slot is never seen, found_volume stays 0, and
MPI2_RAID_ACTION_SYSTEM_SHUTDOWN_INITIATED is never sent — the volume's
write cache is not flushed at poweroff (dirty-shutdown data-integrity risk).

Not applied to sys/ (read-only audit tree); authored after verification.

--- a/sys/dev/raid/mps/mps_sas_lsi.c
+++ b/sys/dev/raid/mps/mps_sas_lsi.c
@@ -901,7 +901,7 @@ mpssas_ir_shutdown(struct mps_softc *sc)
 	end_idx = start_idx + sc->max_volumes - 1;
 
-	for (id = start_idx; id < end_idx; id++) {
+	for (id = start_idx; id <= end_idx; id++) {
 		mt_entry = &sc->mapping_table[id];
 		if ((mt_entry->physical_id != 0) &&
 		    (mt_entry->missing_count == 0)) {