Skip site navigation (1)Skip section navigation (2) 
Date:      Wed, 08 Jun 2022 14:49:25 +0000
From:      bugzilla-noreply@freebsd.org
To:        virtualization@FreeBSD.org
Subject:   [Bug 264548] bhyve's nvme_opc_dataset_mgmt() can free() uninitialized pointer
Message-ID:  <bug-264548-27103@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D264548

            Bug ID: 264548
           Summary: bhyve's nvme_opc_dataset_mgmt() can free()
                    uninitialized pointer
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: bhyve
          Assignee: virtualization@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

Bhyve's nvme_opc_dataset_mgmt() can free(range) before initializing it:

        struct nvme_dsm_range *range;
        ...;
        if ((sc->ctrldata.oncs & NVME_ONCS_DSM) =3D=3D 0) {
                pci_nvme_status_genc(status, NVME_SC_INVALID_OPCODE);
                goto out;
        }
        ...;
        range =3D calloc(1, NVME_MAX_DSM_TRIM);
        ...;
out:
        free(range);

A guest can cause this to happen by ringing the doorbell of a
submission queue with an entry with cmd->opc
NVME_OPC_DATASET_MANAGEMENT.

--=20
You are receiving this mail because:
You are the assignee for the bug.=

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-264548-27103>