⬢ DragonFlyBSD Kernel Audit
DF-4213 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/disk/mpt/mpt_raid.c
+++ b/sys/dev/disk/mpt/mpt_raid.c
@@ -576,8 +576,15 @@
 		break;
 	}
 	action_result = REQ_TO_RAID_ACTION_RESULT(req);
+	/*
+	 * MSG_RAID_ACTION_REPLY.ActionData is a single U32.  Copying
+	 * sizeof(union action_data) (16, MPI_RAID_VOL_INDICATOR) read 12
+	 * bytes of stale reply-frame residue past the reply message.
+	 * The full indicator is returned via the ActionDataSGE buffer,
+	 * never inline in the reply frame.
+	 */
 	memcpy(&action_result->action_data, &reply->ActionData,
-	    sizeof(action_result->action_data));
+	    sizeof(reply->ActionData));
 	action_result->action_status = le16toh(reply->ActionStatus);
 	return (TRUE);
 }