DF-0463
Lockless write to seq->inproc in M_PREPEND failure path: data race
Summary
ng_l2tp_rcvdata_lower(:957-967): seq->inproc=1 under mtx_lock(:957) then unlock(:958). M_PREPEND(:961) on failure clears seq->inproc=0(:963) WITHOUT holding mtx. All other inproc access (:942 read, :975 write) under mutex. Data race -> transient control-packet pipeline inconsistency (unnecessary ZLB drop or premature 2nd packet forward). Self-correcting. No memory corruption.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0463 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 393 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netgraph7/l2tp/ng_l2tp.c:957: lockless write to seq->inproc in M_PREPEND failure path (data race)
Verified recommended fix
Source-confirmed at sys/netgraph7/l2tp/ng_l2tp.c:957: lockless write to seq->inproc in M_PREPEND failure path (data race)
Verdict
Source-confirmed at sys/netgraph7/l2tp/ng_l2tp.c:957: lockless write to seq->inproc in M_PREPEND failure path (data race)
No comments yet.