DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2497

Unbounded disk-index loop in SPAN/JBOD I/O strategy causes OOB read / hang

Summary

JBOD/SPAN branch of ata_raid_strategy walks per-disk sector table with drv++ no bound against MAX_DISKS or total_disks. If bio destination block past sum of configured per-disk sectors (trivially with crafted metadata) drv climbs past rdp->disks[16] reads/writes rdp->disks[N].sectors for N up to whatever it takes to fault leaking kernel heap and panicking. If garbage value read is 0 loop never terminates hang.

Discussion (0)

No comments yet.