Skip site navigation (1)Skip section navigation (2) 
Date:      Tue, 27 Nov 2012 16:37:36 +0000 (UTC)
From:      Jaakko Heinonen <jh@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org
Subject:   svn commit: r243618 - stable/8/sys/dev/md
Message-ID:  <201211271637.qARGbaGn009277@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: jh
Date: Tue Nov 27 16:37:36 2012
New Revision: 243618
URL: http://svnweb.freebsd.org/changeset/base/243618

Log:
  MFC r238991:
  
  Disallow sectorsize larger than MAXPHYS and mediasize smaller than
  sectorsize.
  
  PR:		169947

Modified:
  stable/8/sys/dev/md/md.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/dev/   (props changed)
  stable/8/sys/dev/md/   (props changed)

Modified: stable/8/sys/dev/md/md.c
==============================================================================
--- stable/8/sys/dev/md/md.c	Tue Nov 27 16:23:12 2012	(r243617)
+++ stable/8/sys/dev/md/md.c	Tue Nov 27 16:37:36 2012	(r243618)
@@ -1032,7 +1032,7 @@ mdcreate_swap(struct md_s *sc, struct md
 	 * Range check.  Disallow negative sizes or any size less then the
 	 * size of a page.  Then round to a page.
 	 */
-	if (sc->mediasize == 0 || (sc->mediasize % PAGE_SIZE) != 0)
+	if (sc->mediasize <= 0 || (sc->mediasize % PAGE_SIZE) != 0)
 		return (EDOM);
 
 	/*
@@ -1073,6 +1073,7 @@ xmdctlioctl(struct cdev *dev, u_long cmd
 	struct md_ioctl *mdio;
 	struct md_s *sc;
 	int error, i;
+	unsigned sectsize;
 
 	if (md_debug)
 		printf("mdctlioctl(%s %lx %p %x %p)\n",
@@ -1101,6 +1102,12 @@ xmdctlioctl(struct cdev *dev, u_long cmd
 		default:
 			return (EINVAL);
 		}
+		if (mdio->md_sectorsize == 0)
+			sectsize = DEV_BSIZE;
+		else
+			sectsize = mdio->md_sectorsize;
+		if (sectsize > MAXPHYS || mdio->md_mediasize < sectsize)
+			return (EINVAL);
 		if (mdio->md_options & MD_AUTOUNIT)
 			sc = mdnew(-1, &error, mdio->md_type);
 		else {
@@ -1113,10 +1120,7 @@ xmdctlioctl(struct cdev *dev, u_long cmd
 		if (mdio->md_options & MD_AUTOUNIT)
 			mdio->md_unit = sc->unit;
 		sc->mediasize = mdio->md_mediasize;
-		if (mdio->md_sectorsize == 0)
-			sc->sectorsize = DEV_BSIZE;
-		else
-			sc->sectorsize = mdio->md_sectorsize;
+		sc->sectorsize = sectsize;
 		error = EDOOFUS;
 		switch (sc->type) {
 		case MD_MALLOC:

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201211271637.qARGbaGn009277>