Dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent, non-exploitable)
Summary
vm_unix.c:74 incr declared vm_offset_t (unsigned). :86 assigns uap->incr (size_t, unsigned). :94 if(incr<0) compares unsigned to 0 -> always false -> dead code. Intent (comment :88-93) is reject negative/shrink requests. Behavior still correct today only because subsequent overflow checks (:112,:116) reject negative intptr_t values. Risk: regression if bounds checks relaxed. libc passes intptr_t so negative values arrive as huge unsigned. Fix: if((intptr_t)uap->incr < 0) { error=EOPNOTSUPP; goto done; } before assigning to unsigned incr.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0962 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent, non-expl | 271 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/vm/vm_unix.c:86: dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent)
Verified recommended fix
Source-confirmed at sys/vm/vm_unix.c:86: dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent)
Verdict
Source-confirmed at sys/vm/vm_unix.c:86: dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent)
No comments yet.