[prev in list] [next in list] [prev in thread] [next in thread]
List: freebsd-fs
Subject: [Bug 204358] zfs loader zfs_probe_args secsz is too small, causing memory corruption
From: bugzilla-noreply () freebsd ! org
Date: 2016-01-11 15:36:27
Message-ID: bug-204358-3630-bH2PEIquAK () https ! bugs ! freebsd ! org/bugzilla/
[Download RAW message or body]
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=204358
--- Comment #2 from commit-hook@freebsd.org ---
A commit references this bug:
Author: allanjude
Date: Mon Jan 11 15:35:30 UTC 2016
New revision: 293661
URL: https://svnweb.freebsd.org/changeset/base/293661
Log:
DIOCGSECTORSIZE expects to write to a u_int, but struct zfs_probe_args
member secsz was a uint16_t
sys/boot/zfs/zfs.c has a probe args structure member, secsz, that is a
uint16_t for media sector size; it is used as an argument for ioctl()
at line 484. however, this ioctl writes 32 bits of data (u_int *) and
therefore this ioctl will overwrite and corrupt 16 bits of memory.
other use cases seem to use correct u_int type for secsz.
PR: 204358
Submitted by: Toomas Soome <tsoome at me.com>
Reviewed by: asomers, delphij, smh
MFC after: 5 days
Differential Revision: https://reviews.freebsd.org/D4811
Changes:
head/sys/boot/zfs/zfs.c
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-fs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-fs
To unsubscribe, send any mail to "freebsd-fs-unsubscribe@freebsd.org"
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic