aboutsummaryrefslogtreecommitdiff
path: root/sys/cam/ctl/ctl_tpc.c
diff options
context:
space:
mode:
authorAlexander Motin <mav@FreeBSD.org>2016-05-10 08:28:16 +0000
committerAlexander Motin <mav@FreeBSD.org>2016-05-10 08:28:16 +0000
commit38618bf430ddf96ee1e9e4caaf2d40cd48b1f767 (patch)
treec536608a53ecf5bbe59ba42c598208c9b9d61723 /sys/cam/ctl/ctl_tpc.c
parente13f4248dbcd43aefa718eedf4cc2486365554dd (diff)
downloadsrc-38618bf430ddf96ee1e9e4caaf2d40cd48b1f767.tar.gz
src-38618bf430ddf96ee1e9e4caaf2d40cd48b1f767.zip
Validate XCOPY range offsets and lengths.
MFC after: 2 weeks
Notes
Notes: svn path=/head/; revision=299347
Diffstat (limited to 'sys/cam/ctl/ctl_tpc.c')
-rw-r--r--sys/cam/ctl/ctl_tpc.c14
1 files changed, 11 insertions, 3 deletions
diff --git a/sys/cam/ctl/ctl_tpc.c b/sys/cam/ctl/ctl_tpc.c
index ea5afe7a4429..19d0277acfc7 100644
--- a/sys/cam/ctl/ctl_tpc.c
+++ b/sys/cam/ctl/ctl_tpc.c
@@ -1104,12 +1104,18 @@ tpc_ranges_length(struct scsi_range_desc *range, int nrange)
}
static int
-tpc_check_ranges(struct scsi_range_desc *range, int nrange)
+tpc_check_ranges(struct scsi_range_desc *range, int nrange, uint64_t maxlba)
{
uint64_t b1, b2;
uint32_t l1, l2;
int i, j;
+ for (i = 0; i < nrange; i++) {
+ b1 = scsi_8btou64(range[i].lba);
+ l1 = scsi_4btoul(range[i].length);
+ if (b1 + l1 < b1 || b1 + l1 > maxlba + 1)
+ return (-1);
+ }
for (i = 0; i < nrange - 1; i++) {
b1 = scsi_8btou64(range[i].lba);
l1 = scsi_4btoul(range[i].length);
@@ -2015,7 +2021,8 @@ ctl_populate_token(struct ctl_scsiio *ctsio)
/* Validate list of ranges */
if (tpc_check_ranges(&data->desc[0],
scsi_2btoul(data->range_descriptor_length) /
- sizeof(struct scsi_range_desc))) {
+ sizeof(struct scsi_range_desc),
+ lun->be_lun->maxlba) != 0) {
ctl_set_invalid_field(ctsio, /*sks_valid*/ 0,
/*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
/*bit*/ 0);
@@ -2156,7 +2163,8 @@ ctl_write_using_token(struct ctl_scsiio *ctsio)
/* Validate list of ranges */
if (tpc_check_ranges(&data->desc[0],
scsi_2btoul(data->range_descriptor_length) /
- sizeof(struct scsi_range_desc))) {
+ sizeof(struct scsi_range_desc),
+ lun->be_lun->maxlba) != 0) {
ctl_set_invalid_field(ctsio, /*sks_valid*/ 0,
/*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
/*bit*/ 0);