DF-0369
lagg_port_ioctl fallback forwards ioctl to driver but always returns EINVAL discarding result
Summary
lagg_port_ioctl fallback(:896-902) calls result=(*lp->lp_ioctl)(ifp,cmd,data,cr) into local var then unconditionally return(EINVAL). Driver side effects applied but caller told EINVAL regardless. Dead-store of result. Confused-deputy for ifconfig tooling. Fix: return result.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0369 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 388 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/lagg/if_lagg.c:896: lagg_port_ioctl fallback always returns EINVAL discarding result
Verified recommended fix
Source-confirmed at sys/net/lagg/if_lagg.c:896: lagg_port_ioctl fallback always returns EINVAL discarding result
Verdict
Source-confirmed at sys/net/lagg/if_lagg.c:896: lagg_port_ioctl fallback always returns EINVAL discarding result
No comments yet.