CVS commit: src/sys/dev/scsipi

[Taylor R Campbell]

Module Name:    src
Committed By:   riastradh
Date:           Sat Mar 12 16:57:16 UTC 2022

Modified Files:
        src/sys/dev/scsipi: scsiconf.c

Log Message:
scsi(9): Handle bogus number of LUNs in SCSI_REPORT_LUNS.

Reported-by: syzbot+76ef9084533d4bcce...@syzkaller.appspotmail.com


To generate a diff of this commit:
cvs rdiff -u -r1.299 -r1.300 src/sys/dev/scsipi/scsiconf.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/scsipi/scsiconf.c
diff -u src/sys/dev/scsipi/scsiconf.c:1.299 src/sys/dev/scsipi/scsiconf.c:1.300
--- src/sys/dev/scsipi/scsiconf.c:1.299	Sat Mar 12 15:32:32 2022
+++ src/sys/dev/scsipi/scsiconf.c	Sat Mar 12 16:57:15 2022
@@ -1,4 +1,4 @@
-/*	$NetBSD: scsiconf.c,v 1.299 2022/03/12 15:32:32 riastradh Exp $	*/
+/*	$NetBSD: scsiconf.c,v 1.300 2022/03/12 16:57:15 riastradh Exp $	*/
 
 /*-
  * Copyright (c) 1998, 1999, 2004 The NetBSD Foundation, Inc.
@@ -48,7 +48,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: scsiconf.c,v 1.299 2022/03/12 15:32:32 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: scsiconf.c,v 1.300 2022/03/12 16:57:15 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -400,7 +400,7 @@ scsi_report_luns(struct scsibus_softc *s
 	uint16_t tmp;
 
 	int error;
-	size_t i, rlrlen;
+	size_t i, rlrlen, rlrlenmin;
 
 	memset(&replun, 0, sizeof(replun));
 
@@ -421,7 +421,7 @@ scsi_report_luns(struct scsibus_softc *s
 		goto end2;
 	}
 
-	rlrlen = sizeof(*rlr) + sizeof(*lunp) * 1;
+	rlrlen = rlrlenmin = sizeof(*rlr) + sizeof(*lunp) * 1;
 
 again:
 	rlr = kmem_zalloc(rlrlen, KM_SLEEP);
@@ -443,6 +443,10 @@ again:
 		    16383 * sizeof(*lunp));
 		kmem_free(rlr, old_rlrlen);
 		rlr = NULL;
+		if (rlrlen < rlrlenmin) {
+			error = EIO;
+			goto end;
+		}
 		goto again;
 	}