aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGordon Tetlow <gordon@FreeBSD.org>2020-07-08 19:58:00 +0000
committerGordon Tetlow <gordon@FreeBSD.org>2020-07-08 19:58:00 +0000
commit0cae766bdc191ebd2a7c48ee6668ed2ad28e0eb9 (patch)
treee91e738497c7004d0ba457707db41daf46314290
parente268defb43a8d584e5f116ffb2054df91d9c91af (diff)
downloadsrc-0cae766bdc191ebd2a7c48ee6668ed2ad28e0eb9.tar.gz
src-0cae766bdc191ebd2a7c48ee6668ed2ad28e0eb9.zip
Fix kernel panic in mps(4) driver.
Approved by: so Security: FreeBSD-EN-20:15.mps
Notes
Notes: svn path=/releng/12.1/; revision=363024
-rw-r--r--sys/dev/mps/mps_user.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/sys/dev/mps/mps_user.c b/sys/dev/mps/mps_user.c
index 714236071b35..526bfd6c8ef5 100644
--- a/sys/dev/mps/mps_user.c
+++ b/sys/dev/mps/mps_user.c
@@ -1045,10 +1045,12 @@ mps_user_pass_thru(struct mps_softc *sc, mps_pass_thru_t *data)
if (((MPI2_SCSI_IO_REPLY *)rpl)->SCSIState &
MPI2_SCSI_STATE_AUTOSENSE_VALID) {
sense_len =
- MIN((le32toh(((MPI2_SCSI_IO_REPLY *)rpl)->SenseCount)),
- sizeof(struct scsi_sense_data));
+ MIN((le32toh(((MPI2_SCSI_IO_REPLY *)rpl)->
+ SenseCount)), sizeof(struct
+ scsi_sense_data));
mps_unlock(sc);
- copyout(cm->cm_sense, cm->cm_req + 64, sense_len);
+ copyout(cm->cm_sense, (PTRIN(data->PtrReply +
+ sizeof(MPI2_SCSI_IO_REPLY))), sense_len);
mps_lock(sc);
}
}