sglist_consume_uio truncates iov_len (size_t) to int - signedness confusion / data drop (dead code)
Summary
sglist_consume_uio (subr_sglist.c:389 int len; :404 len=iov->iov_len size_t->int truncation). iov_len multiple of 2^32 -> len=0 silently skipped (:405). iov_len>INT_MAX other -> len negative -> if(len>resid) signed/unsigned mix -> _sglist_append_buf huge length walk pages past iovec buffer. ZERO in-tree callers. Fix: size_t len.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0097 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 283 B | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.3 KB | ↓ raw |
| README.md | readme | reproduce instructions | 768 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0097 — REPRODUCED (source-only)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
none (DoS) on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/subr_sglist.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
sglist_consume_uio: int len at :389; len=iov->iov_len at :404 truncates size_t→int. iov_len multiple of 2^32 → len=0 silently skipped at :405; iov_len>INT_MAX other → len negative → if(len>resid) signed/unsigned mix → _sglist_append_buf gets a huge size.
DF-0097 — REPRODUCED (source-only)
Verdict
REPRODUCED (source-only)
Mechanism
sglist_consume_uio: int len at :389; len=iov->iov_len at :404 truncates size_t→int. iov_len multiple of 2^32 → len=0 silently skipped at :405; iov_len>INT_MAX other → len negative → if(len>resid) signed/unsigned mix → _sglist_append_buf gets a huge size.
Source trace
- File:
sys/kern/subr_sglist.c - References: sys/kern/subr_sglist.c:389, sys/kern/subr_sglist.c:404, sys/kern/subr_sglist.c:410
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
Change int len to size_t len so the truncation/mix cannot occur. Matches finding proposal.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: int len truncates / patched: size_t len, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- u
- b
- r
- _
- s
- g
- l
- i
- s
- t
- .
- c
- :
- 3
- 8
- 9
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- u
- b
- r
- _
- s
- g
- l
- i
- s
- t
- .
- c
- :
- 4
- 0
- 4
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- u
- b
- r
- _
- s
- g
- l
- i
- s
- t
- .
- c
- :
- 4
- 1
- 0
Detail
Exploit chain
none (DoS / correctness)
Evidence (decisive lines)
subr_sglist.c:389 int len truncates iov_len.
PoC changes
Authored fix.diff: change int len to size_t len.
Verified recommended fix
Change int len to size_t len so the size_t→int truncation and signed/unsigned mix cannot occur. Matches finding proposal.
Verdict
REPRODUCED (source-only). subr_sglist.c:389 int len; :404 len=iov->iov_len truncates size_t→int. iov_len multiple of 2^32 → len=0 silently skipped; iov_len>INT_MAX → len negative → if(len>resid) signed/unsigned mix → _sglist_append_buf gets huge size.
No comments yet.