Fix a scribbler in the PMS driver.
The ESGL bit was left uninitialized when executing the REPORT LUNS ioctl. This could allow a zeroed data buffer to be treated as a scatter/gather list. The firmware would eventually walk past the end of the data buffer, potentially find what looked like a valid address/length pair, and write the result to semi-random memory. Obtained from: Dell EMC Isilon MFC after: 1 week Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D19398
This commit is contained in:
parent
6f9dbc0e6e
commit
2fb6802f27
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=345009
@ -1874,7 +1874,9 @@ tiNumOfLunIOCTLreq(
|
||||
|
||||
agSSPFrame->dataLength = REPORT_LUN_LEN;
|
||||
agSSPFrame->agSgl.len = sizeof(agsaSSPCmdInfoUnit_t);
|
||||
|
||||
agSSPFrame->agSgl.extReserved = 0;
|
||||
CLEAR_ESGL_EXTEND(agSSPFrame->agSgl.extReserved);
|
||||
|
||||
status = saSSPStart(agRoot, agIORequest, 0, agDevHandle, agRequestType,agSASRequestBody,agNULL,
|
||||
&ossaSSPIoctlCompleted);
|
||||
if(status != AGSA_RC_SUCCESS)
|
||||
|
Loading…
Reference in New Issue
Block a user