⬢ DragonFlyBSD Kernel Audit
DF-1473 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
diff --git a/sys/dev/raid/mpr/mpr_sas_lsi.c b/sys/dev/raid/mpr/mpr_sas_lsi.c
--- a/sys/dev/raid/mpr/mpr_sas_lsi.c
+++ b/sys/dev/raid/mpr/mpr_sas_lsi.c
@@ -133,7 +133,8 @@
     MPI2_EVENT_NOTIFICATION_REPLY *event)
 {
 	struct mpr_fw_event_work *fw_event;
-	u16 sz;
+	u32 sz;	/* DF-1473: was u16 — EventDataLength*4 truncated, causing
+			   kmalloc(0)/ZERO_LENGTH_PTR panic and undersized allocs */
 
 	mpr_dprint(sc, MPR_TRACE, "%s\n", __func__);
 	MPR_DPRINT_EVENT(sc, sas, event);