DF-1459
bzero of softc uses sizeof(pointer) instead of sizeof(struct) - latent garbage init
Summary
cyapa_attach at cyapa.c:488: bzero(sc, sizeof(struct cyapa_softc *)) uses sizeof(pointer)=8 not sizeof(struct)~440. Benign only because subr_bus.c kmalloc uses M_ZERO. Fix: remove the * to get sizeof(struct cyapa_softc).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1459 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | bzero of softc uses sizeof(pointer) instead of sizeof(struct) - latent garbage i | 307 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/smbus/cyapa/cyapa.c:488: bzero of softc uses sizeof(pointer) instead of sizeof(struct) - garbage init
Verified recommended fix
Source-confirmed at sys/dev/smbus/cyapa/cyapa.c:488: bzero of softc uses sizeof(pointer) instead of sizeof(struct) - garbage init
Verdict
Source-confirmed at sys/dev/smbus/cyapa/cyapa.c:488: bzero of softc uses sizeof(pointer) instead of sizeof(struct) - garbage init
No comments yet.