[Bug 266115] bad use of user pointer in cam_ioctl() CTL_PORT_REQ

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=266115

--- Comment #1 from Robert Morris <rtm@lcs.mit.edu> ---
Similarly, for a CTL_LUN_REQ ioctl, if the user program sets backend[]
to "block", lun_req->result_nvl to e.g. 0x8000000000000000, and
lun_req->result to NULL, backend->ioctl() (which is
ctl_be_block_ioctl()) won't modify reslt_nvl, but ctl_ioctl() will
call nvlist_destroy(lun_req->result_nvl), causing a crash.

-- 
You are receiving this mail because:
You are the assignee for the bug.