upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-08 16:22:46 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

mmc: fix 1-byte reallocs (when it should have been sizeof device_t)

Browse source 
Reported by KASAN:
panic: ASan: Invalid access, 8-byte write at 0xfffffe00f0992610, RedZonePartial(1)
panic() at panic+0xb5/frame 0xffffffff86a595b0
__asan_store8_noabort() at __asan_store8_noabort+0x376/frame 0xffffffff86a59670
mmc_go_discovery() at mmc_go_discovery+0x6c61/frame 0xffffffff86a5a790
mmc_delayed_attach() at mmc_delayed_attach+0x35/frame 0xffffffff86a5a7b0
[snip]

Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Mateusz Guzik 2021-09-25 14:49:43 +02:00
parent d71e1a883c
commit 13c63ae08d
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sys/dev/mmc/mmc.c
View file

@ -1920,7 +1920,7 @@ child_common:
if (child != NULL) {
device_set_ivars(child, ivar);
sc->child_list = realloc(sc->child_list,
sizeof(device_t) * sc->child_count + 1,
sizeof(device_t) * (sc->child_count + 1),
M_DEVBUF, M_WAITOK);
sc->child_list[sc->child_count++] = child;
} else