DF-0098
sglist_consume_uio loop does not check uio_iovcnt before reading uio_iov (defense-in-depth, dead code)
Summary
sglist_consume_uio (subr_sglist.c:402): while(resid>0 && uio_resid) no uio_iovcnt>0 check; iovcnt only decremented len==0 branch (:407). If caller passes uio with uio_resid>0 but all iov exhausted -> derefs uio_iov past iov array -> OOB read. Standard uio keeps resid consistent. Defense-in-depth. ZERO in-tree callers. Fix: add && uio_iovcnt>0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0098 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | sglist_consume_uio loop does not check uio_iovcnt before reading uio_iov (defens | 322 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/subr_sglist.c:402: no uio_iovcnt check before reading uio_iov (dead code)
Verified recommended fix
Source-confirmed at sys/kern/subr_sglist.c:402: no uio_iovcnt check before reading uio_iov (dead code)
Verdict
Source-confirmed at sys/kern/subr_sglist.c:402: no uio_iovcnt check before reading uio_iov (dead code)
No comments yet.