aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGordon Tetlow <gordon@FreeBSD.org>2020-07-08 19:58:00 +0000
committerGordon Tetlow <gordon@FreeBSD.org>2020-07-08 19:58:00 +0000
commit408abd846a4a55662515dcdb3790fd9b1cd39f95 (patch)
tree5f34f7e9359379ee8df9ee5ea8c75caf29d74e5f
parent8c639945a44588f6cfdddfb057bb5aad88735da0 (diff)
downloadsrc-408abd846a4a55662515dcdb3790fd9b1cd39f95.tar.gz
src-408abd846a4a55662515dcdb3790fd9b1cd39f95.zip
Fix kernel panic in mps(4) driver.
Approved by: so Security: FreeBSD-EN-20:15.mps
Notes
Notes: svn path=/releng/11.4/; revision=363024
-rw-r--r--sys/dev/mps/mps_user.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/sys/dev/mps/mps_user.c b/sys/dev/mps/mps_user.c
index b5c4160c70a2..1abe3c535642 100644
--- a/sys/dev/mps/mps_user.c
+++ b/sys/dev/mps/mps_user.c
@@ -1036,10 +1036,12 @@ mps_user_pass_thru(struct mps_softc *sc, mps_pass_thru_t *data)
if (((MPI2_SCSI_IO_REPLY *)rpl)->SCSIState &
MPI2_SCSI_STATE_AUTOSENSE_VALID) {
sense_len =
- MIN((le32toh(((MPI2_SCSI_IO_REPLY *)rpl)->SenseCount)),
- sizeof(struct scsi_sense_data));
+ MIN((le32toh(((MPI2_SCSI_IO_REPLY *)rpl)->
+ SenseCount)), sizeof(struct
+ scsi_sense_data));
mps_unlock(sc);
- copyout(cm->cm_sense, cm->cm_req + 64, sense_len);
+ copyout(cm->cm_sense, (PTRIN(data->PtrReply +
+ sizeof(MPI2_SCSI_IO_REPLY))), sense_len);
mps_lock(sc);
}
}