diff options
| author | mlelstv <mlelstv@NetBSD.org> | 2019-05-26 08:12:41 +0000 |
|---|---|---|
| committer | mlelstv <mlelstv@NetBSD.org> | 2019-05-26 08:12:41 +0000 |
| commit | f7557657f986bdfd3a7e4ba28a1ae1bfa8fc6bf8 (patch) | |
| tree | 14a1eecef395712cb4162fe6bcb25d612f109973 /sys/dev | |
| parent | 97949cc3ef3b23b79f0e6aac20f644c4fb36dd45 (diff) | |
Add sanity checks to SCIOCCOMMAND, adapter drivers might be confused or trigger
assertions (e.g. umass).
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/scsipi/scsipi_ioctl.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/sys/dev/scsipi/scsipi_ioctl.c b/sys/dev/scsipi/scsipi_ioctl.c index e15b5776ef3..a0e4a6bd530 100644 --- a/sys/dev/scsipi/scsipi_ioctl.c +++ b/sys/dev/scsipi/scsipi_ioctl.c @@ -1,4 +1,4 @@ -/* $NetBSD: scsipi_ioctl.c,v 1.70 2018/09/03 16:29:33 riastradh Exp $ */ +/* $NetBSD: scsipi_ioctl.c,v 1.71 2019/05/26 08:12:41 mlelstv Exp $ */ /*- * Copyright (c) 1998, 2004 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: scsipi_ioctl.c,v 1.70 2018/09/03 16:29:33 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: scsipi_ioctl.c,v 1.71 2019/05/26 08:12:41 mlelstv Exp $"); #ifdef _KERNEL_OPT #include "opt_compat_freebsd.h" @@ -328,10 +328,18 @@ scsipi_do_ioctl(struct scsipi_periph *periph, dev_t dev, u_long cmd, struct scsi_ioctl *si; int len; + len = screq->datalen; + + /* + * If there is data, there must be a data buffer and a direction specified + */ + if (len > 0 && (screq->databuf == NULL || + (screq->flags & (SCCMD_READ|SCCMD_WRITE)) == 0)) + return (EINVAL); + si = si_get(); si->si_screq = *screq; si->si_periph = periph; - len = screq->datalen; if (len) { si->si_iov.iov_base = screq->databuf; si->si_iov.iov_len = len; |
