Date: Mon, 11 Jan 2016 15:36:27 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-fs@FreeBSD.org Subject: [Bug 204358] zfs loader zfs_probe_args secsz is too small, causing memory corruption Message-ID: <bug-204358-3630-bH2PEIquAK@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-204358-3630@https.bugs.freebsd.org/bugzilla/> References: <bug-204358-3630@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D204358 --- Comment #2 from commit-hook@freebsd.org --- A commit references this bug: Author: allanjude Date: Mon Jan 11 15:35:30 UTC 2016 New revision: 293661 URL: https://svnweb.freebsd.org/changeset/base/293661 Log: DIOCGSECTORSIZE expects to write to a u_int, but struct zfs_probe_args member secsz was a uint16_t sys/boot/zfs/zfs.c has a probe args structure member, secsz, that is a uint16_t for media sector size; it is used as an argument for ioctl() at line 484. however, this ioctl writes 32 bits of data (u_int *) and therefore this ioctl will overwrite and corrupt 16 bits of memory. other use cases seem to use correct u_int type for secsz. PR: 204358 Submitted by: Toomas Soome <tsoome at me.com> Reviewed by: asomers, delphij, smh MFC after: 5 days Differential Revision: https://reviews.freebsd.org/D4811 Changes: head/sys/boot/zfs/zfs.c --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-204358-3630-bH2PEIquAK>