Date: Thu, 15 Aug 2024 19:34:22 GMT From: Jessica Clarke <jrtc27@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 3cded0592208 - main - tmpfs: Fix OOB write when setting vfs.tmpfs.memory_percent Message-ID: <202408151934.47FJYMuR042673@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by jrtc27: URL: https://cgit.FreeBSD.org/src/commit/?id=3cded0592208b465761af6db5b7b7c21cb5b28c3 commit 3cded0592208b465761af6db5b7b7c21cb5b28c3 Author: Jessica Clarke <jrtc27@FreeBSD.org> AuthorDate: 2024-08-15 19:33:22 +0000 Commit: Jessica Clarke <jrtc27@FreeBSD.org> CommitDate: 2024-08-15 19:33:22 +0000 tmpfs: Fix OOB write when setting vfs.tmpfs.memory_percent tmpfs_mem_percent is an int not a long, so on a 64-bit system this writes 4 bytes past the end of the variable. The read above is correct, so this was likely a copy paste error from sysctl_mem_reserved. Found by: CHERI Fixes: 636592343c3e ("tmpfs: increase memory reserve to a percent of available memory + swap") --- sys/fs/tmpfs/tmpfs_subr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/fs/tmpfs/tmpfs_subr.c b/sys/fs/tmpfs/tmpfs_subr.c index 3f74c383a171..a5eb865f2996 100644 --- a/sys/fs/tmpfs/tmpfs_subr.c +++ b/sys/fs/tmpfs/tmpfs_subr.c @@ -428,7 +428,7 @@ sysctl_mem_percent(SYSCTL_HANDLER_ARGS) if ((unsigned) percent > 100) return (EINVAL); - *(long *)arg1 = percent; + *(int *)arg1 = percent; tmpfs_set_reserve_from_percent(); return (0); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202408151934.47FJYMuR042673>