[Midnightbsd-cvs] [MidnightBSD/src] 81c68c: fwcontrol: Allocate full fw_asyreq structures pass...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 81c68ccd3c66dfe2cf435135c171aeb6471c712d
      https://github.com/MidnightBSD/src/commit/81c68ccd3c66dfe2cf435135c171aeb6471c712d
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2024-12-01 (Sun, 01 Dec 2024)

  Changed paths:
    M usr.sbin/fwcontrol/fwcontrol.c

  Log Message:
  -----------
  fwcontrol: Allocate full fw_asyreq structures passed to the kernel
The FW_ASYREQ ioctl accepts a struct fw_asyreq object as its argument,
meaning that the kernel always copies in the full structure in
sys_ioctl before passing the request down to the driver.  However,
fwcontrol was allocating smaller objects that contained only the
request header and a variable-sized payload.  This means that the
kernel copy in sys_ioctl was reading off the end of this buffer.  On
current architectures this happened to be ok, but it is UB.



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications