diff options
| author | Sean Bruno <sbruno@FreeBSD.org> | 2016-04-19 18:27:28 +0000 |
|---|---|---|
| committer | Sean Bruno <sbruno@FreeBSD.org> | 2016-04-19 18:27:28 +0000 |
| commit | f4a18258b0fb0d5f14f6e801854a042d6d552048 (patch) | |
| tree | fe58f3a0d263b01e4532f17adba1a23adf56a3d3 /sys/dev/aacraid | |
| parent | bbea316cc87598dd38013c8e4e034f705c363b3e (diff) | |
Notes
Diffstat (limited to 'sys/dev/aacraid')
| -rw-r--r-- | sys/dev/aacraid/aacraid.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/sys/dev/aacraid/aacraid.c b/sys/dev/aacraid/aacraid.c index 879d46690268..42a16c420393 100644 --- a/sys/dev/aacraid/aacraid.c +++ b/sys/dev/aacraid/aacraid.c @@ -2873,15 +2873,25 @@ aac_ioctl_send_raw_srb(struct aac_softc *sc, caddr_t arg) if (fibsize == (sizeof(struct aac_srb) + srbcmd->sg_map.SgCount * sizeof(struct aac_sg_entry))) { struct aac_sg_entry *sgp = srbcmd->sg_map.SgEntry; - srb_sg_bytecount = sgp->SgByteCount; - srb_sg_address = (u_int64_t)sgp->SgAddress; + struct aac_sg_entry sg; + + if ((error = copyin(sgp, &sg, sizeof(sg))) != 0) + goto out; + + srb_sg_bytecount = sg.SgByteCount; + srb_sg_address = (u_int64_t)sg.SgAddress; } else if (fibsize == (sizeof(struct aac_srb) + srbcmd->sg_map.SgCount * sizeof(struct aac_sg_entry64))) { #ifdef __LP64__ struct aac_sg_entry64 *sgp = (struct aac_sg_entry64 *)srbcmd->sg_map.SgEntry; - srb_sg_bytecount = sgp->SgByteCount; - srb_sg_address = sgp->SgAddress; + struct aac_sg_entry64 sg; + + if ((error = copyin(sgp, &sg, sizeof(sg))) != 0) + goto out; + + srb_sg_bytecount = sg.SgByteCount; + srb_sg_address = sg.SgAddress; if (srb_sg_address > 0xffffffffull && !(sc->flags & AAC_FLAGS_SG_64BIT)) #endif |