d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Validate the buffer and its length passed to QLA_MPI_DUMP.

Browse Source 
copyout dump only if qls_mpi_core_dump() is successful.
(like to credit x90c for pointing the issue)
Submitted by:David C Somayajulu
This commit is contained in:
davidcs 2013-11-15 01:44:58 +00:00
parent ab896e34f3
commit eae6b3d774
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/dev/qlxge/qls_ioctl.c
View File

@ -100,13 +100,16 @@ qls_eioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag,
if (mpi_dump->size == 0) {
mpi_dump->size = sizeof (qls_mpi_coredump_t);
} else {
if (mpi_dump->size < sizeof (qls_mpi_coredump_t))
if ((mpi_dump->size != sizeof (qls_mpi_coredump_t)) ||
(mpi_dump->dbuf == NULL))
rval = EINVAL;
else {
qls_mpi_core_dump(ha);
rval = copyout( &ql_mpi_coredump,
if (qls_mpi_core_dump(ha) == 0) {
rval = copyout(&ql_mpi_coredump,
mpi_dump->dbuf,
mpi_dump->size);
} else
rval = ENXIO;
if (rval) {
device_printf(ha->pci_dev,