DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2480

daddr_t (int32) truncation of block address for >1TB MMC/SD media

Summary

mmcsd_rw and mmcsd_delete declare block/end as daddr_t which is __int32_t. For SDXC/large eMMC beyond 2^31 sectors (~1TiB at 512B) bio->bio_offset/sz silently truncates to possibly-negative 32-bit value producing wrong MMC command arguments and depending on card behavior either spurious EIO or data corruption at wrong sector. block=bio->bio_offset/sz assignment truncates to int32. cmd.arg=block reinterprets negative as uint32 0xFFFFFFFF sent to card. Affects mmcsd_delete too.

Discussion (0)

No comments yet.