vm_page_alloc_contig silently ignores alignment, boundary, and low address constraints
Summary
vm_page_alloc_contig accepts alignment/boundary/low params but never enforces them: alist_alloc(alist,start,count) at :2809 takes no alignment param; only high is checked at :2819; low is only used in kprintf at :2841. Non-power-of-2 sizes and boundary constraints entirely unenforced. Caller proceeds assuming constraints met -> silent DMA misalignment or hardware malfunction. Fallback scanning allocator vm_contig_pg_alloc DOES enforce all constraints but vm_page_alloc_contig is tried first and trusted.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0943 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 383 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/vm/vm_page.c:2764: vm_page_alloc_contig silently ignores alignment/boundary/low constraints
Verified recommended fix
Source-confirmed at sys/vm/vm_page.c:2764: vm_page_alloc_contig silently ignores alignment/boundary/low constraints
Verdict
Source-confirmed at sys/vm/vm_page.c:2764: vm_page_alloc_contig silently ignores alignment/boundary/low constraints
No comments yet.