Signed integer overflow (C UB) in lock range end calculation (caught by guard, no corruption reachable)
Summary
kern_lockf.c:233 end=start+fl->l_len-1 signed 64-bit add can overflow for large l_start/l_len (e.g. l_start=1 l_len=LLONG_MAX). Signed overflow is C UB (C11 6.5). if(end<start) guard :234 effective under 2s-complement wraparound (dangerous cases produce end<=start rejected; benign start=0/l_len=LLONG_MAX -> end=LLONG_MAX-1). Same pattern SEEK_END start=size+fl->l_start :217 mixed uint/int. No memory corruption reachable (guard catches). -fwrapv typical. Code-quality defense-in-depth.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0069 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Signed integer overflow (C UB) in lock range end calculation (caught by guard, n | 298 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_lockf.c:227: signed int overflow in lock range end calc (caught by guard)
Verified recommended fix
Source-confirmed at sys/kern/kern_lockf.c:227: signed int overflow in lock range end calc (caught by guard)
Verdict
Source-confirmed at sys/kern/kern_lockf.c:227: signed int overflow in lock range end calc (caught by guard)
No comments yet.