HomeFreeBSD

bhyve: Initialize stack buffer in pci_ahci

Description

bhyve: Initialize stack buffer in pci_ahci

In the function ahci_handle_dsm_trim, if the call to read_prdt fails,
the variable buf[512] is used while it contains uninitialized data.

It is easy to make the call to read_prdt fail, for instance if
hdr->prdtl == NULL, the function will return without writing anything in
buf.

In addition, this code could be hardened by checking the value of done
before accessing &buf[done].

Reported by: Synacktiv
Reviewed by: markj
Security: HYP-15
Sponsored by: The Alpha-Omega Project
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46090

Details

Provenance
khorben_defora.orgAuthored on Jul 23 2024, 2:34 PM
emasteCommitted on Sep 26 2024, 6:06 PM
Reviewer
markj
Differential Revision
Restricted Differential Revision
Parents
rGa3d5dec42007: release(7): fix the spelling of git.FreeBSD.org
Branches
Unknown
Tags
Unknown