DF-0131
fp_mmap size arithmetic can wrap past SSIZE_MAX after signedness check
Summary
fp_mmap rejects (ssize_t)size<0(:409) but size+=pageoff(:416)+round_page(:417) can push past SSIZE_MAX. No wrap re-check (unlike sys_msync:474). Contained by vm_mmap downstream validation. Phantom success if wraps to 0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0131 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 383 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_fp.c:409: fp_mmap size arithmetic can wrap past SSIZE_MAX
Verified recommended fix
Source-confirmed at sys/kern/kern_fp.c:409: fp_mmap size arithmetic can wrap past SSIZE_MAX
Verdict
Source-confirmed at sys/kern/kern_fp.c:409: fp_mmap size arithmetic can wrap past SSIZE_MAX
No comments yet.