summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authormlelstv <mlelstv@NetBSD.org>2019-05-26 08:12:41 +0000
committermlelstv <mlelstv@NetBSD.org>2019-05-26 08:12:41 +0000
commitf7557657f986bdfd3a7e4ba28a1ae1bfa8fc6bf8 (patch)
tree14a1eecef395712cb4162fe6bcb25d612f109973
parent97949cc3ef3b23b79f0e6aac20f644c4fb36dd45 (diff)
Add sanity checks to SCIOCCOMMAND, adapter drivers might be confused or trigger
assertions (e.g. umass).
-rw-r--r--sys/dev/scsipi/scsipi_ioctl.c14
1 files changed, 11 insertions, 3 deletions
diff --git a/sys/dev/scsipi/scsipi_ioctl.c b/sys/dev/scsipi/scsipi_ioctl.c
index e15b5776ef3..a0e4a6bd530 100644
--- a/sys/dev/scsipi/scsipi_ioctl.c
+++ b/sys/dev/scsipi/scsipi_ioctl.c
@@ -1,4 +1,4 @@
-/* $NetBSD: scsipi_ioctl.c,v 1.70 2018/09/03 16:29:33 riastradh Exp $ */
+/* $NetBSD: scsipi_ioctl.c,v 1.71 2019/05/26 08:12:41 mlelstv Exp $ */
/*-
* Copyright (c) 1998, 2004 The NetBSD Foundation, Inc.
@@ -37,7 +37,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: scsipi_ioctl.c,v 1.70 2018/09/03 16:29:33 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: scsipi_ioctl.c,v 1.71 2019/05/26 08:12:41 mlelstv Exp $");
#ifdef _KERNEL_OPT
#include "opt_compat_freebsd.h"
@@ -328,10 +328,18 @@ scsipi_do_ioctl(struct scsipi_periph *periph, dev_t dev, u_long cmd,
struct scsi_ioctl *si;
int len;
+ len = screq->datalen;
+
+ /*
+ * If there is data, there must be a data buffer and a direction specified
+ */
+ if (len > 0 && (screq->databuf == NULL ||
+ (screq->flags & (SCCMD_READ|SCCMD_WRITE)) == 0))
+ return (EINVAL);
+
si = si_get();
si->si_screq = *screq;
si->si_periph = periph;
- len = screq->datalen;
if (len) {
si->si_iov.iov_base = screq->databuf;
si->si_iov.iov_len = len;