⬢ DragonFlyBSD Kernel Audit
DF-5374 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/cam/scsi/scsi_target.c
+++ b/sys/bus/cam/scsi/scsi_target.c
@@ -565,6 +565,12 @@
 
 	softc = (struct targ_softc *)ap->a_head.a_dev->si_drv1;
 	write_len = error = 0;
+
+	/* CCBs can only be accepted once a LUN has been enabled. */
+	if (softc->periph == NULL ||
+	    (softc->state & TARG_STATE_LUN_ENABLED) == 0) {
+		return (ENXIO);
+	}
 	CAM_DEBUG(softc->path, CAM_DEBUG_PERIPH,
 		  ("write - uio_resid %zu\n", uio->uio_resid));
 	while (uio->uio_resid >= sizeof(user_ccb) && error == 0) {
@@ -868,6 +874,12 @@
 	softc = (struct targ_softc *)ap->a_head.a_dev->si_drv1;
 	user_queue = &softc->user_ccb_queue;
 	abort_queue = &softc->abort_queue;
+
+	/* Completions can only be fetched once a LUN has been enabled. */
+	if (softc->periph == NULL ||
+	    (softc->state & TARG_STATE_LUN_ENABLED) == 0) {
+		return (ENXIO);
+	}
 	CAM_DEBUG(softc->path, CAM_DEBUG_PERIPH, ("targread\n"));
 
 	/* If no data is available, wait or return immediately */