[Bug 266115] bad use of user pointer in cam_ioctl() CTL_PORT_REQ

From: <bugzilla-noreply_at_freebsd.org>
Date: Wed, 31 Aug 2022 15:15:40 UTC

--- Comment #1 from Robert Morris <rtm@lcs.mit.edu> ---
Similarly, for a CTL_LUN_REQ ioctl, if the user program sets backend[]
to "block", lun_req->result_nvl to e.g. 0x8000000000000000, and
lun_req->result to NULL, backend->ioctl() (which is
ctl_be_block_ioctl()) won't modify reslt_nvl, but ctl_ioctl() will
call nvlist_destroy(lun_req->result_nvl), causing a crash.

You are receiving this mail because:
You are the assignee for the bug.