ng_fec_input defined 2 params but assigned to 4-param if_input slot: calling-convention UB
Summary
ng_fec_input(:862-863) defined as 2-param (ifp,m0). if_input slot type(if_var.h:354-356) is 4-param (ifp,m,pktinfo,cpuid). Line :443 assigns 2-arg fn to 4-arg slot. HW RX drivers call ifp->if_input(ifp,m,pi,cpuid)(if_var.h:67). Incompatible pointer type UB C11 6.5.2.2. x86-64 silently ignores extra args. Stack-passing ABI -> caller pushes 4, callee pops 2 -> frame corruption. Fix: add 2 missing params to match if_input signature.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0505 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-confirmation + fix | 1.0 KB | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0505 — Low-severity source-confirmation
Verdict: NOT_REPRODUCED
Impact: none Confidence: certain
Kernel ref: netgraph7/ng_fec.c:188
Mechanism / why
FALSE POSITIVE: ng_fec_input declaration (ng_fec.c:188-190) IS 4-param matching the if_input slot; only the definition is 2-param, so extra args are dropped harmlessly per the x86-64 ABI. No corruption.
Recommended fix
No code change needed: false positive (declaration matches the slot; extra args harmlessly dropped).
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
Confirmed kernel references
- n
- e
- t
- g
- r
- a
- p
- h
- 7
- /
- n
- g
- _
- f
- e
- c
- .
- c
- :
- 1
- 8
- 8
Detail
Exploit chain
none (false positive)
Evidence (decisive lines)
DF-0505 [NOT_REPRODUCED] - netgraph7/ng_fec.c:188
PoC changes
no code change (false positive) in findings/poc/DF-0505/
Verified recommended fix
No code change needed: false positive (declaration matches the slot; extra args harmlessly dropped).
Verdict
FALSE POSITIVE: ng_fec_input declaration (ng_fec.c:188-190) IS 4-param matching the if_input slot; only the definition is 2-param, so extra args are dropped harmlessly per the x86-64 ABI. No corruption.
No comments yet.