DF-0384
delete_pipe uses DN_NR_HASH_MAX(16) instead of DN_PIPE_NR_MAX(65536): pipes 17-65536 undeletable — same as v1
Summary
delete_pipe(:1645) validates pipe_nr>DN_NR_HASH_MAX(16) not DN_PIPE_NR_MAX(65536). config_pipe accepts 1..65536. Copy/paste of hash bucket count instead of pipe space. Same bug as DF-0373 (v1). Resource leak: pipes 17-65536 only removable via FLUSH.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0384 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | delete_pipe uses DN_NR_HASH_MAX(16) instead of DN_PIPE_NR_MAX(65536): pipes 17-6 | 414 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/dummynet3/ip_dummynet3.c:1645: delete_pipe uses wrong bound (16 vs 65536)
Verified recommended fix
Source-confirmed at sys/net/dummynet3/ip_dummynet3.c:1645: delete_pipe uses wrong bound (16 vs 65536)
Verdict
Source-confirmed at sys/net/dummynet3/ip_dummynet3.c:1645: delete_pipe uses wrong bound (16 vs 65536)
No comments yet.