tmpfs: Fix OOB write when setting vfs.tmpfs.memory_percent

tmpfs_mem_percent is an int not a long, so on a 64-bit system this
writes 4 bytes past the end of the variable. The read above is correct,
so this was likely a copy paste error from sysctl_mem_reserved.

Found by:	CHERI
Fixes:		636592343c ("tmpfs: increase memory reserve to a percent of available memory + swap")

This commit is contained in:

Jessica Clarke

2024-08-15 20:33:22 +01:00

parent ef9fc9609a

commit 3cded05922

1 changed files with 1 additions and 1 deletions

									
										sys/fs/tmpfs/tmpfs_subr.c
									
		+1
		-1
	
												View File
												
				@@ -428,7 +428,7 @@ sysctl_mem_percent(SYSCTL_HANDLER_ARGS)

					if ((unsigned) percent > 100)

						return (EINVAL);

					*(long *)arg1 = percent;

					*(int *)arg1 = percent;

					tmpfs_set_reserve_from_percent();

					return (0);

				}