Date: Mon, 11 Jan 2016 15:35:29 +0000 (UTC) From: Allan Jude <allanjude@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r293661 - head/sys/boot/zfs Message-ID: <201601111535.u0BFZUEf096870@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: allanjude Date: Mon Jan 11 15:35:29 2016 New Revision: 293661 URL: https://svnweb.freebsd.org/changeset/base/293661 Log: DIOCGSECTORSIZE expects to write to a u_int, but struct zfs_probe_args member secsz was a uint16_t sys/boot/zfs/zfs.c has a probe args structure member, secsz, that is a uint16_t for media sector size; it is used as an argument for ioctl() at line 484. however, this ioctl writes 32 bits of data (u_int *) and therefore this ioctl will overwrite and corrupt 16 bits of memory. other use cases seem to use correct u_int type for secsz. PR: 204358 Submitted by: Toomas Soome <tsoome at me.com> Reviewed by: asomers, delphij, smh MFC after: 5 days Differential Revision: https://reviews.freebsd.org/D4811 Modified: head/sys/boot/zfs/zfs.c Modified: head/sys/boot/zfs/zfs.c ============================================================================== --- head/sys/boot/zfs/zfs.c Mon Jan 11 15:30:19 2016 (r293660) +++ head/sys/boot/zfs/zfs.c Mon Jan 11 15:35:29 2016 (r293661) @@ -413,7 +413,7 @@ struct zfs_probe_args { int fd; const char *devname; uint64_t *pool_guid; - uint16_t secsz; + u_int secsz; }; static int
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201601111535.u0BFZUEf096870>