⬢ DragonFlyBSD Kernel Audit
DF-5362 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/pccard/pccard_cis.c
+++ b/sys/bus/pccard/pccard_cis.c
@@ -104,6 +104,7 @@
 	struct pccard_tuple tuple;
 	int longlink_present;
 	int longlink_common;
+	int chain_hops = 0;		/* DF-5362 cycle guard */
 	u_long longlink_addr;		/* Type suspect */
 	int mfc_count;
 	int mfc_index;
@@ -384,6 +385,16 @@
 		 * try the next one, instead of just bailing.
 		 */
 		while (1) {
+			/* DF-5362: LONGLINK_A/C tuples parsed inside a
+			 * followed chain re-arm longlink_present, so a
+			 * cyclic chain graph never terminates.  Real
+			 * cards use one implicit longlink plus at most
+			 * 50 MFC links; cut off pathological graphs. */
+			if (++chain_hops > 64) {
+				device_printf(dev, "CIS chain hop limit"
+					    " exceeded (cycle?) -- truncating\n");
+				goto done;
+			}
 			if (longlink_present) {
 				CARD_SET_RES_FLAGS(device_get_parent(dev), dev,
 				    SYS_RES_MEMORY, rid, longlink_common ?