summaryrefslogtreecommitdiff
path: root/sys/dev/scsipi
diff options
context:
space:
mode:
authormlelstv <mlelstv@NetBSD.org>2020-10-26 11:39:48 +0000
committermlelstv <mlelstv@NetBSD.org>2020-10-26 11:39:48 +0000
commitc9efebafbc532092d255b086c85be22808746e10 (patch)
tree3a1958fdf6b9cc8ea3b695ad12c1f053fc48b135 /sys/dev/scsipi
parentb27feef873afb35d008227c0e9e6ee127c96ab09 (diff)
Avoid buffer overflow when copying from bounce buffer.
Fixes PR 54810 Don't use uninitialized pointer in split bounce buffer case and free a partially allocated bounce buffer on error.
Diffstat (limited to 'sys/dev/scsipi')
-rw-r--r--sys/dev/scsipi/cd.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/sys/dev/scsipi/cd.c b/sys/dev/scsipi/cd.c
index 2ec050ee917..1eba06ebb38 100644
--- a/sys/dev/scsipi/cd.c
+++ b/sys/dev/scsipi/cd.c
@@ -1,4 +1,4 @@
-/* $NetBSD: cd.c,v 1.348 2020/09/29 03:04:03 msaitoh Exp $ */
+/* $NetBSD: cd.c,v 1.349 2020/10/26 11:39:48 mlelstv Exp $ */
/*-
* Copyright (c) 1998, 2001, 2003, 2004, 2005, 2008 The NetBSD Foundation,
@@ -50,7 +50,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: cd.c,v 1.348 2020/09/29 03:04:03 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: cd.c,v 1.349 2020/10/26 11:39:48 mlelstv Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -667,7 +667,7 @@ cd_make_bounce(struct cd_softc *cd, struct buf *bp, struct cdbounce **bouncep)
cd_iosize(dksc->sc_dev, &count);
bounce->head = skip * DEV_BSIZE;
- bounce->lcount = count - bounce->head;
+ bounce->lcount = imin(count - bounce->head, bp->b_bcount);
bounce->rcount = bp->b_bcount - bounce->lcount;
error = cd_make_bounce_buffer(cd, bp, blkno, count, &lbp, bounce);
@@ -678,10 +678,10 @@ cd_make_bounce(struct cd_softc *cd, struct buf *bp, struct cdbounce **bouncep)
count = total - count;
if (count > 0) {
- bounce->lbp->b_private = bounce;
error = cd_make_bounce_buffer(cd, bp, blkno, count, &rbp, bounce);
if (error) {
- putiobuf(bounce->lbp);
+ free(lbp->b_data, M_DEVBUF);
+ putiobuf(lbp);
goto bad;
}
} else