d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mpr, mps: Fix an off-by-one bug in the BTDH_MAPPING ioctl

Browse Source 
The device mapping table contains sc->max_devices entries, so only
indices in [0, sc->max_devices) are valid.

MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D27964
This commit is contained in:
Mark Johnston 2021-01-08 13:32:05 -05:00
parent de828a91db
commit adc0dcc352
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/dev/mpr/mpr_user.c
View File

@ -2226,7 +2226,7 @@ mpr_user_btdh(struct mpr_softc *sc, mpr_btdh_mapping_t *data)
if (bus != 0)
return (EINVAL);
if (target > sc->max_devices) {
if (target >= sc->max_devices) {
mpr_dprint(sc, MPR_XINFO, "Target ID is out of range "
"for Bus/Target to DevHandle mapping.");
return (EINVAL);

2
sys/dev/mps/mps_user.c
View File

@ -2128,7 +2128,7 @@ mps_user_btdh(struct mps_softc *sc, mps_btdh_mapping_t *data)
if (bus != 0)
return (EINVAL);
if (target > sc->max_devices) {
if (target >= sc->max_devices) {
mps_dprint(sc, MPS_FAULT, "Target ID is out of range "
"for Bus/Target to DevHandle mapping.");
return (EINVAL);