DF-0461
Potential signed integer overflow in kern_load burst-adaptation math
Summary
Line :1019 kern_load=(kern_load*pollhz)/10000 both int32. pollhz up to 30049. Mul overflows int when single poll cycle >71ms (the very stall scenario iopoll_clock detects). Signed int overflow UB. Wrong burst direction only. No memory corruption. Not attacker-controlled. Fix: cast int64 before mul.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0461 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 383 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/if_poll.c:1019: potential signed int overflow in kern_load burst-adaptation math
Verified recommended fix
Source-confirmed at sys/net/if_poll.c:1019: potential signed int overflow in kern_load burst-adaptation math
Verdict
Source-confirmed at sys/net/if_poll.c:1019: potential signed int overflow in kern_load burst-adaptation math
No comments yet.