diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-08-21 14:53:54 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-08-21 14:57:31 +0000 |
| commit | 97e24b41d2d224cfb4043f1ae84fc23d9033d0a1 (patch) | |
| tree | 4e26716407149d103c09a319d46b6cf96a5c9868 /test/CodeGenCXX/conversion-function.cpp | |
| parent | 250db717b24d084c0a3193226a79b73a69fbfe0f (diff) | |
6e474d8e3981 ("staging: vchiq_shim: avoid code duplication") refactors
some code which makes applying the subsequent patch easier.
49bec49fd7f2 ("staging: vc04_services: remove vchiq_copy_from_user")
addresses a user-triggerable integer overflow via the
VCHIQ_IOC_QUEUE_MESSAGE ioctl on /dev/vchiq (which has mode 0600 by
default). It also addresses insufficient validation of user-controlled
addresses in vchiq_copy_from_user().
Update the bcm2835_audio driver to follow the change to
vchi_msg_queue().
Reported by: Vicki Pfau
Reviewed by: Abdelkader Boudih <freebsd@seuros.com>
Tested by: Abdelkader Boudih <freebsd@seuros.com>
Tested by: Marco Devesas Campos <devesas.campos@gmail.com>
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58889
Diffstat (limited to 'test/CodeGenCXX/conversion-function.cpp')
0 files changed, 0 insertions, 0 deletions