[Bug 227058] vxge(4): ioctl implementation reads directly from user memory

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=227058

            Bug ID: 227058
           Summary: vxge(4): ioctl implementation reads directly from user
                    memory
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: brooks at FreeBSD.org

Most of the access to ifr_data is wrong.  This will work by accident some of
the time, but will cause crashes in others.

An example:

vxge_ioctl_regs(vxge_dev_t *vdev, struct ifreq *ifr)
{
        ...
        char *command = ifr->ifr_data;   // ***** user pointer *****
        ...
        switch (*command) {              // ***** read from user pointer *****

-- 
You are receiving this mail because:
You are the assignee for the bug.