β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0943

vm_page_alloc_contig silently ignores alignment, boundary, and low address constraints

Summary

vm_page_alloc_contig accepts alignment/boundary/low params but never enforces them: alist_alloc(alist,start,count) at :2809 takes no alignment param; only high is checked at :2819; low is only used in kprintf at :2841. Non-power-of-2 sizes and boundary constraints entirely unenforced. Caller proceeds assuming constraints met -> silent DMA misalignment or hardware malfunction. Fallback scanning allocator vm_contig_pg_alloc DOES enforce all constraints but vm_page_alloc_contig is tried first and trusted.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0943 Β· 1 files
FileTypeDescriptionSize
manifest.json file 383 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/vm/vm_page.c:2764: vm_page_alloc_contig silently ignores alignment/boundary/low constraints

Verified recommended fix

Source-confirmed at sys/vm/vm_page.c:2764: vm_page_alloc_contig silently ignores alignment/boundary/low constraints

Verdict

Source-confirmed at sys/vm/vm_page.c:2764: vm_page_alloc_contig silently ignores alignment/boundary/low constraints