From adc0dcc352bb9f5a67a054d95c6959ea5aa26d91 Mon Sep 17 00:00:00 2001 From: Mark Johnston Date: Fri, 8 Jan 2021 13:32:05 -0500 Subject: [PATCH] mpr, mps: Fix an off-by-one bug in the BTDH_MAPPING ioctl The device mapping table contains sc->max_devices entries, so only indices in [0, sc->max_devices) are valid. MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D27964 --- sys/dev/mpr/mpr_user.c | 2 +- sys/dev/mps/mps_user.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/dev/mpr/mpr_user.c b/sys/dev/mpr/mpr_user.c index 236e5c9715df..cab865e2e535 100644 --- a/sys/dev/mpr/mpr_user.c +++ b/sys/dev/mpr/mpr_user.c @@ -2226,7 +2226,7 @@ mpr_user_btdh(struct mpr_softc *sc, mpr_btdh_mapping_t *data) if (bus != 0) return (EINVAL); - if (target > sc->max_devices) { + if (target >= sc->max_devices) { mpr_dprint(sc, MPR_XINFO, "Target ID is out of range " "for Bus/Target to DevHandle mapping."); return (EINVAL); diff --git a/sys/dev/mps/mps_user.c b/sys/dev/mps/mps_user.c index c80fbc68cdf3..9d4aab54562f 100644 --- a/sys/dev/mps/mps_user.c +++ b/sys/dev/mps/mps_user.c @@ -2128,7 +2128,7 @@ mps_user_btdh(struct mps_softc *sc, mps_btdh_mapping_t *data) if (bus != 0) return (EINVAL); - if (target > sc->max_devices) { + if (target >= sc->max_devices) { mps_dprint(sc, MPS_FAULT, "Target ID is out of range " "for Bus/Target to DevHandle mapping."); return (EINVAL);