svn commit: r242699 - stable/9/sys/dev/md

[Jaakko Heinonen]

Author: jh
Date: Wed Nov  7 16:52:01 2012
New Revision: 242699
URL: http://svnweb.freebsd.org/changeset/base/242699

Log:
  MFC r238991:
  
  Disallow sectorsize larger than MAXPHYS and mediasize smaller than
  sectorsize.
  
  PR:		169947

Modified:
  stable/9/sys/dev/md/md.c
Directory Properties:
  stable/9/sys/   (props changed)
  stable/9/sys/dev/   (props changed)

Modified: stable/9/sys/dev/md/md.c
==============================================================================
--- stable/9/sys/dev/md/md.c	Wed Nov  7 16:34:09 2012	(r242698)
+++ stable/9/sys/dev/md/md.c	Wed Nov  7 16:52:01 2012	(r242699)
@@ -1081,7 +1081,7 @@ mdcreate_swap(struct md_s *sc, struct md
 	 * Range check.  Disallow negative sizes or any size less then the
 	 * size of a page.  Then round to a page.
 	 */
-	if (sc->mediasize == 0 || (sc->mediasize % PAGE_SIZE) != 0)
+	if (sc->mediasize <= 0 || (sc->mediasize % PAGE_SIZE) != 0)
 		return (EDOM);
 
 	/*
@@ -1122,6 +1122,7 @@ xmdctlioctl(struct cdev *dev, u_long cmd
 	struct md_ioctl *mdio;
 	struct md_s *sc;
 	int error, i;
+	unsigned sectsize;
 
 	if (md_debug)
 		printf("mdctlioctl(%s %lx %p %x %p)\n",
@@ -1150,6 +1151,12 @@ xmdctlioctl(struct cdev *dev, u_long cmd
 		default:
 			return (EINVAL);
 		}
+		if (mdio->md_sectorsize == 0)
+			sectsize = DEV_BSIZE;
+		else
+			sectsize = mdio->md_sectorsize;
+		if (sectsize > MAXPHYS || mdio->md_mediasize < sectsize)
+			return (EINVAL);
 		if (mdio->md_options & MD_AUTOUNIT)
 			sc = mdnew(-1, &error, mdio->md_type);
 		else {
@@ -1162,10 +1169,7 @@ xmdctlioctl(struct cdev *dev, u_long cmd
 		if (mdio->md_options & MD_AUTOUNIT)
 			mdio->md_unit = sc->unit;
 		sc->mediasize = mdio->md_mediasize;
-		if (mdio->md_sectorsize == 0)
-			sc->sectorsize = DEV_BSIZE;
-		else
-			sc->sectorsize = mdio->md_sectorsize;
+		sc->sectorsize = sectsize;
 		error = EDOOFUS;
 		switch (sc->type) {
 		case MD_MALLOC: