Module Name: src
Committed By: chs
Date: Wed Feb 12 00:19:07 UTC 2020
Modified Files:
src/sys/dev/scsipi: atapi_wdc.c
Log Message:
the number of possible ATAPI devices on an ATA bus is not always 2,
it is however many devices the underlying ATA bus can have (eg. 1 for SATA),
so initialize the scsipi chan_ntargets from the ATA ch_ndrives.
this fixes a memory read overrun detected by KASAN.
discussed with mlelstv@ and jdolecek@
To generate a diff of this commit:
cvs rdiff -u -r1.134 -r1.135 src/sys/dev/scsipi/atapi_wdc.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/scsipi/atapi_wdc.c
diff -u src/sys/dev/scsipi/atapi_wdc.c:1.134 src/sys/dev/scsipi/atapi_wdc.c:1.135
--- src/sys/dev/scsipi/atapi_wdc.c:1.134 Sun Nov 10 21:16:37 2019
+++ src/sys/dev/scsipi/atapi_wdc.c Wed Feb 12 00:19:07 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: atapi_wdc.c,v 1.134 2019/11/10 21:16:37 chs Exp $ */
+/* $NetBSD: atapi_wdc.c,v 1.135 2020/02/12 00:19:07 chs Exp $ */
/*
* Copyright (c) 1998, 2001 Manuel Bouyer.
@@ -25,7 +25,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: atapi_wdc.c,v 1.134 2019/11/10 21:16:37 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: atapi_wdc.c,v 1.135 2020/02/12 00:19:07 chs Exp $");
#ifndef ATADEBUG
#define ATADEBUG
@@ -138,7 +138,7 @@ wdc_atapibus_attach(struct atabus_softc
chan->chan_flags = SCSIPI_CHAN_OPENINGS;
chan->chan_openings = 1;
chan->chan_max_periph = 1;
- chan->chan_ntargets = 2;
+ chan->chan_ntargets = chp->ch_ndrives;
chan->chan_nluns = 1;
chp->atapibus = config_found_ia(ata_sc->sc_dev, "atapi", chan,
