diff options
| author | riastradh <riastradh@NetBSD.org> | 2022-03-12 16:57:15 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2022-03-12 16:57:15 +0000 |
| commit | 9cc20f90b6dc3dc9add6ebdb856d0b54a9899162 (patch) | |
| tree | fe4f76989a744dbd2ade74b34ac089a3c7312e81 /sys/dev/scsipi | |
| parent | efa561cbfc5678dd895745522b0d2677b9c1d0cf (diff) | |
scsi(9): Handle bogus number of LUNs in SCSI_REPORT_LUNS.
Reported-by: syzbot+76ef9084533d4bccec66@syzkaller.appspotmail.com
Diffstat (limited to 'sys/dev/scsipi')
| -rw-r--r-- | sys/dev/scsipi/scsiconf.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/sys/dev/scsipi/scsiconf.c b/sys/dev/scsipi/scsiconf.c index 17ca9687c45..88349c54a3e 100644 --- a/sys/dev/scsipi/scsiconf.c +++ b/sys/dev/scsipi/scsiconf.c @@ -1,4 +1,4 @@ -/* $NetBSD: scsiconf.c,v 1.299 2022/03/12 15:32:32 riastradh Exp $ */ +/* $NetBSD: scsiconf.c,v 1.300 2022/03/12 16:57:15 riastradh Exp $ */ /*- * Copyright (c) 1998, 1999, 2004 The NetBSD Foundation, Inc. @@ -48,7 +48,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: scsiconf.c,v 1.299 2022/03/12 15:32:32 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: scsiconf.c,v 1.300 2022/03/12 16:57:15 riastradh Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -400,7 +400,7 @@ scsi_report_luns(struct scsibus_softc *sc, int target, uint16_t tmp; int error; - size_t i, rlrlen; + size_t i, rlrlen, rlrlenmin; memset(&replun, 0, sizeof(replun)); @@ -421,7 +421,7 @@ scsi_report_luns(struct scsibus_softc *sc, int target, goto end2; } - rlrlen = sizeof(*rlr) + sizeof(*lunp) * 1; + rlrlen = rlrlenmin = sizeof(*rlr) + sizeof(*lunp) * 1; again: rlr = kmem_zalloc(rlrlen, KM_SLEEP); @@ -443,6 +443,10 @@ again: 16383 * sizeof(*lunp)); kmem_free(rlr, old_rlrlen); rlr = NULL; + if (rlrlen < rlrlenmin) { + error = EIO; + goto end; + } goto again; } |
