⬢ DragonFlyBSD Kernel Audit
DF-2465 / run.log
← back to finding ↓ download raw
===DF-2465: production i_setopt with headerDigest="CRC32C"===
$ /root/miscctl isopt
dfmisc: PRODUCTION i_setopt(headerDigest="CRC32C") rv=0 hdrDigest=0
(crc32_ext=0) -> CRC32C REJECTED: strcmp compared past the
non-NUL-terminated 6-byte hdigest buffer (copyinstr returned
ENAMETOOLONG after copying 6 bytes with no NUL)

Chain demonstrated on the production function (iscsi_initiator.ko
symbol): copyinstr(&hdigest, 6) copies all 6 chars of "CRC32C" with no
room for the NUL -> ENAMETOOLONG; the != EFAULT guard at isc_subr.c:129
admits it; strcmp(hdigest, "CRC32C") at :130 reads hdigest[6..] (kernel
stack past the 6-byte buffer) until some NUL, and since the adjacent
stack byte is non-zero the comparison can never match -- hdrDigest
stays NULL: CRC32C header-digest negotiation is silently broken, and
the strcmp over-read past hdigest[5] is real (bounded by the nearest
NUL).  Default builds compile sdebug out, so no console leak channel.