diff options
| author | mlelstv <mlelstv@NetBSD.org> | 2020-10-26 11:39:48 +0000 |
|---|---|---|
| committer | mlelstv <mlelstv@NetBSD.org> | 2020-10-26 11:39:48 +0000 |
| commit | c9efebafbc532092d255b086c85be22808746e10 (patch) | |
| tree | 3a1958fdf6b9cc8ea3b695ad12c1f053fc48b135 /sys/dev/scsipi | |
| parent | b27feef873afb35d008227c0e9e6ee127c96ab09 (diff) | |
Avoid buffer overflow when copying from bounce buffer.
Fixes PR 54810
Don't use uninitialized pointer in split bounce buffer case and
free a partially allocated bounce buffer on error.
Diffstat (limited to 'sys/dev/scsipi')
| -rw-r--r-- | sys/dev/scsipi/cd.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/sys/dev/scsipi/cd.c b/sys/dev/scsipi/cd.c index 2ec050ee917..1eba06ebb38 100644 --- a/sys/dev/scsipi/cd.c +++ b/sys/dev/scsipi/cd.c @@ -1,4 +1,4 @@ -/* $NetBSD: cd.c,v 1.348 2020/09/29 03:04:03 msaitoh Exp $ */ +/* $NetBSD: cd.c,v 1.349 2020/10/26 11:39:48 mlelstv Exp $ */ /*- * Copyright (c) 1998, 2001, 2003, 2004, 2005, 2008 The NetBSD Foundation, @@ -50,7 +50,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: cd.c,v 1.348 2020/09/29 03:04:03 msaitoh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: cd.c,v 1.349 2020/10/26 11:39:48 mlelstv Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -667,7 +667,7 @@ cd_make_bounce(struct cd_softc *cd, struct buf *bp, struct cdbounce **bouncep) cd_iosize(dksc->sc_dev, &count); bounce->head = skip * DEV_BSIZE; - bounce->lcount = count - bounce->head; + bounce->lcount = imin(count - bounce->head, bp->b_bcount); bounce->rcount = bp->b_bcount - bounce->lcount; error = cd_make_bounce_buffer(cd, bp, blkno, count, &lbp, bounce); @@ -678,10 +678,10 @@ cd_make_bounce(struct cd_softc *cd, struct buf *bp, struct cdbounce **bouncep) count = total - count; if (count > 0) { - bounce->lbp->b_private = bounce; error = cd_make_bounce_buffer(cd, bp, blkno, count, &rbp, bounce); if (error) { - putiobuf(bounce->lbp); + free(lbp->b_data, M_DEVBUF); + putiobuf(lbp); goto bad; } } else |
