git: 3cded0592208 - main - tmpfs: Fix OOB write when setting vfs.tmpfs.memory_percent

From: Jessica Clarke <jrtc27_at_FreeBSD.org>
Date: Thu, 15 Aug 2024 19:34:22 UTC
The branch main has been updated by jrtc27:

URL: https://cgit.FreeBSD.org/src/commit/?id=3cded0592208b465761af6db5b7b7c21cb5b28c3

commit 3cded0592208b465761af6db5b7b7c21cb5b28c3
Author:     Jessica Clarke <jrtc27@FreeBSD.org>
AuthorDate: 2024-08-15 19:33:22 +0000
Commit:     Jessica Clarke <jrtc27@FreeBSD.org>
CommitDate: 2024-08-15 19:33:22 +0000

    tmpfs: Fix OOB write when setting vfs.tmpfs.memory_percent
    
    tmpfs_mem_percent is an int not a long, so on a 64-bit system this
    writes 4 bytes past the end of the variable. The read above is correct,
    so this was likely a copy paste error from sysctl_mem_reserved.
    
    Found by:       CHERI
    Fixes:          636592343c3e ("tmpfs: increase memory reserve to a percent of available memory + swap")
---
 sys/fs/tmpfs/tmpfs_subr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/fs/tmpfs/tmpfs_subr.c b/sys/fs/tmpfs/tmpfs_subr.c
index 3f74c383a171..a5eb865f2996 100644
--- a/sys/fs/tmpfs/tmpfs_subr.c
+++ b/sys/fs/tmpfs/tmpfs_subr.c
@@ -428,7 +428,7 @@ sysctl_mem_percent(SYSCTL_HANDLER_ARGS)
 	if ((unsigned) percent > 100)
 		return (EINVAL);
 
-	*(long *)arg1 = percent;
+	*(int *)arg1 = percent;
 	tmpfs_set_reserve_from_percent();
 	return (0);
 }