DF-0378
SET_TICKS computes len*8*dn_hz in int: overflow for jumbo packets at high dn_hz -> shaper bypass
Summary
SET_TICKS(:431-433) and ready_event(:483)/ready_event_wfq(:549): len*8*dn_hz computed as signed int32. At dn_hz=10000 a 65535-byte packet -> 5.24e9 > INT_MAX -> wraps negative. Negative len_scaled in ready_event: q->numbytes-=len_scaled (u_long) adds huge credit -> queue drains far beyond configured bandwidth -> shaper bypass. Limited real-world: needs high dn_hz + jumbo.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0378 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 395 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/dummynet/ip_dummynet.c:431: SET_TICKS int overflow for jumbo packets at high dn_hz
Verified recommended fix
Source-confirmed at sys/net/dummynet/ip_dummynet.c:431: SET_TICKS int overflow for jumbo packets at high dn_hz
Verdict
Source-confirmed at sys/net/dummynet/ip_dummynet.c:431: SET_TICKS int overflow for jumbo packets at high dn_hz
No comments yet.