Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent kernel crashes caused by umass devices that return bogus mode sense

Browse Source 
data, such as the "Cooler Master". From Rhialto. While there, clean up some
debugging code and make the offset unsigned.
This commit is contained in:
christos 2006-11-30 17:59:35 +00:00
parent d048649c18
commit 409998ac55
1 changed files with 36 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
sys/dev/scsipi/sd.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: sd.c,v 1.257 2006/11/29 21:06:49 drochner Exp $ */
/* $NetBSD: sd.c,v 1.258 2006/11/30 17:59:35 christos Exp $ */
/*-
* Copyright (c) 1998, 2003, 2004 The NetBSD Foundation, Inc.
@ -54,7 +54,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: sd.c,v 1.257 2006/11/29 21:06:49 drochner Exp $");
__KERNEL_RCSID(0, "$NetBSD: sd.c,v 1.258 2006/11/30 17:59:35 christos Exp $");
#include "opt_scsi.h"
#include "rnd.h"
@ -1887,12 +1887,9 @@ sd_get_parms_page4(struct sd_softc *sd, struct disk_parms *dp, int flags)
{
struct sd_mode_sense_data scsipi_sense;
int error;
int big, poffset, byte2;
int big, byte2;
size_t poffset;
union scsi_disk_pages *pages;
#if 0
int i;
u_int8_t *p;
#endif
byte2 = SMS_DBD;
again:
@ -1918,10 +1915,23 @@ again:
poffset += scsipi_sense.header.small.blk_desc_len;
}
if (poffset > sizeof(scsipi_sense) - sizeof(pages->rigid_geometry))
return ERESTART;
pages = (void *)((u_long)&scsipi_sense + poffset);
#if 0
printf("page 4 sense:"); for (i = sizeof(scsipi_sense), p = (void *)&scsipi_sense; i; i--, p++) printf(" %02x", *p); printf("\n");
printf("page 4 pg_code=%d sense=%p/%p\n", pages->rigid_geometry.pg_code, &scsipi_sense, pages);
{
size_t i;
u_int8_t *p;
printf("page 4 sense:");
for (i = sizeof(scsipi_sense), p = (void *)&scsipi_sense; i;
i--, p++)
printf(" %02x", *p);
printf("\n");
printf("page 4 pg_code=%d sense=%p/%p\n",
pages->rigid_geometry.pg_code, &scsipi_sense, pages);
}
#endif
if ((pages->rigid_geometry.pg_code & PGCODE_MASK) != 4)
@ -1962,12 +1972,9 @@ sd_get_parms_page5(struct sd_softc *sd, struct disk_parms *dp, int flags)
{
struct sd_mode_sense_data scsipi_sense;
int error;
int big, poffset, byte2;
int big, byte2;
size_t poffset;
union scsi_disk_pages *pages;
#if 0
int i;
u_int8_t *p;
#endif
byte2 = SMS_DBD;
again:
@ -1993,10 +2000,23 @@ again:
poffset += scsipi_sense.header.small.blk_desc_len;
}
if (poffset > sizeof(scsipi_sense) - sizeof(pages->flex_geometry))
return ERESTART;
pages = (void *)((u_long)&scsipi_sense + poffset);
#if 0
printf("page 5 sense:"); for (i = sizeof(scsipi_sense), p = (void *)&scsipi_sense; i; i--, p++) printf(" %02x", *p); printf("\n");
printf("page 5 pg_code=%d sense=%p/%p\n", pages->flex_geometry.pg_code, &scsipi_sense, pages);
{
size_t i;
u_int8_t *p;
printf("page 5 sense:");
for (i = sizeof(scsipi_sense), p = (void *)&scsipi_sense; i;
i--, p++)
printf(" %02x", *p);
printf("\n");
printf("page 5 pg_code=%d sense=%p/%p\n",
pages->flex_geometry.pg_code, &scsipi_sense, pages);
}
#endif
if ((pages->flex_geometry.pg_code & PGCODE_MASK) != 5)