diff options
| author | Renato Botelho <renato@netgate.com> | 2016-05-09 17:39:11 -0300 |
|---|---|---|
| committer | Renato Botelho <renato@netgate.com> | 2016-05-09 17:39:11 -0300 |
| commit | eb1aa95459d780e1328d821fd6af261c2221a62b (patch) | |
| tree | d0c75db0de1902022252ffee3acbfe775366214c /sys/dev/aacraid/aacraid.c | |
| parent | 4a578420216361b8acfb7296dd0b68c805e5121b (diff) | |
| parent | 1708fafa25d9413ab466d3670d803e2ebf885d45 (diff) | |
| download | FreeBSD-src-eb1aa95459d780e1328d821fd6af261c2221a62b.zip FreeBSD-src-eb1aa95459d780e1328d821fd6af261c2221a62b.tar.gz | |
Merge remote-tracking branch 'origin/stable/10' into devel
Diffstat (limited to 'sys/dev/aacraid/aacraid.c')
| -rw-r--r-- | sys/dev/aacraid/aacraid.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/sys/dev/aacraid/aacraid.c b/sys/dev/aacraid/aacraid.c index 7c300a6..b0ab8a1 100644 --- a/sys/dev/aacraid/aacraid.c +++ b/sys/dev/aacraid/aacraid.c @@ -2873,15 +2873,25 @@ aac_ioctl_send_raw_srb(struct aac_softc *sc, caddr_t arg) if (fibsize == (sizeof(struct aac_srb) + srbcmd->sg_map.SgCount * sizeof(struct aac_sg_entry))) { struct aac_sg_entry *sgp = srbcmd->sg_map.SgEntry; - srb_sg_bytecount = sgp->SgByteCount; - srb_sg_address = (u_int64_t)sgp->SgAddress; + struct aac_sg_entry sg; + + if ((error = copyin(sgp, &sg, sizeof(sg))) != 0) + goto out; + + srb_sg_bytecount = sg.SgByteCount; + srb_sg_address = (u_int64_t)sg.SgAddress; } else if (fibsize == (sizeof(struct aac_srb) + srbcmd->sg_map.SgCount * sizeof(struct aac_sg_entry64))) { #ifdef __LP64__ struct aac_sg_entry64 *sgp = (struct aac_sg_entry64 *)srbcmd->sg_map.SgEntry; - srb_sg_bytecount = sgp->SgByteCount; - srb_sg_address = sgp->SgAddress; + struct aac_sg_entry64 sg; + + if ((error = copyin(sgp, &sg, sizeof(sg))) != 0) + goto out; + + srb_sg_bytecount = sg.SgByteCount; + srb_sg_address = sg.SgAddress; if (srb_sg_address > 0xffffffffull && !(sc->flags & AAC_FLAGS_SG_64BIT)) #endif |
