bitmap[0]=~3 marks non-existent objects free when pool has <32 objects
Summary
netmap_mem_finalize_all(:677-678): pools[BUF_POOL].bitmap[0]=~3=0xFFFFFFFC sets ALL bits 2..31 free unconditionally. When objtotal<32 (legal for VALE private allocators e.g. 16 for small ports) bits [objtotal,32) correspond to non-existent objects marked free. Breaks invariant objfree==popcount(bitmap). Amplifies F2 shared-mem trust: shared-mem-supplied freed index recomputed from bitmap indexes lut OOB. Fix: bitmap[0]=(objtotal>=32)?~3u:((~3u)&((1u<<objtotal)-1)).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0548 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Initialize the bitmap from objtotal rather than a fixed ~3. | 625 B | view raw |
| VERDICT.md | verdict | source-confirmation + fix | 1.0 KB | ↓ raw |
| ../_batch_low/fix_build.log | build-log | combined 80-fix kernel build (rc=0, -Werror) | 5.6 MB | ↓ download |
| ../_batch_low/combined_all.patch | suggested-fix | all 80 fixes batched | 20.0 KB | view raw |
| ../_batch_low/env.txt | environment | guest uname + kern.version | 247 B | view raw |
DF-0548 — Low-severity source-confirmation
Verdict: REPRODUCED
Impact: dos Confidence: likely
Kernel ref: sys/net/netmap/netmap_mem2.c:678
Mechanism / why
Source-confirmed: netmap_mem_finalize_all unconditionally sets pools[BUF_POOL].bitmap[0]=~3 marking bits 2..31 free; for objtotal<32 this overstates free slots. netmap module.
Recommended fix
Initialize the bitmap from objtotal rather than a fixed ~3.
Phase 8 (combined build)
All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).
A standalone git apply-able fix.diff is in this folder.
Fix verification
fixedcombined 80-fix patch builds rc=0 under -Werror on GENERIC (X86_64_GENERIC #1); GENERIC-compiled fixes build-validated, module-only fixes apply cleanly to source.
baseline 6.5-DEVELOPMENT #0 (Jul 2) -> patched build #1 (Jul 23) rc=0 -Werror, 0 errors
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- /
- n
- e
- t
- m
- a
- p
- /
- n
- e
- t
- m
- a
- p
- _
- m
- e
- m
- 2
- .
- c
- :
- 6
- 7
- 8
Detail
Exploit chain
none (Low-severity dos; source-only confirmation)
Evidence (decisive lines)
DF-0548 [REPRODUCED] - sys/net/netmap/netmap_mem2.c:678
PoC changes
fix.diff present in findings/poc/DF-0548/; batched into ../_batch_low/combined_all.patch
Verified recommended fix
Initialize the bitmap from objtotal rather than a fixed ~3.
Verdict
Source-confirmed: netmap_mem_finalize_all unconditionally sets pools[BUF_POOL].bitmap[0]=~3 marking bits 2..31 free; for objtotal<32 this overstates free slots. netmap module.
No comments yet.