DF-0159
xio_init_pages accepts negative npages; only upper bound asserted
Summary
xio_init_pages(:147) KKASSERT(npages<=XIO_INTERNAL_PAGES) only. Negative npages stored in xio_npages(:153), xio_bytes=npages*PAGE_SIZE negative(:151). Latent state corruption, no callers pass negative today.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0159 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | xio_init_pages accepts negative npages; only upper bound asserted | 244 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_xio.c:142: xio_init_pages accepts negative npages; only upper bound asserted
Verified recommended fix
Source-confirmed at sys/kern/kern_xio.c:142: xio_init_pages accepts negative npages; only upper bound asserted
Verdict
Source-confirmed at sys/kern/kern_xio.c:142: xio_init_pages accepts negative npages; only upper bound asserted
No comments yet.