β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0962

Dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent, non-exploitable)

Summary

vm_unix.c:74 incr declared vm_offset_t (unsigned). :86 assigns uap->incr (size_t, unsigned). :94 if(incr<0) compares unsigned to 0 -> always false -> dead code. Intent (comment :88-93) is reject negative/shrink requests. Behavior still correct today only because subsequent overflow checks (:112,:116) reject negative intptr_t values. Risk: regression if bounds checks relaxed. libc passes intptr_t so negative values arrive as huge unsigned. Fix: if((intptr_t)uap->incr < 0) { error=EOPNOTSUPP; goto done; } before assigning to unsigned incr.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0962 Β· 1 files
FileTypeDescriptionSize
fix.diff suggested-fix Dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent, non-expl 271 B view raw

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff applied + combined nativekernel build rc=0 (-Werror)

fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/vm/vm_unix.c:86: dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent)

Verified recommended fix

Source-confirmed at sys/vm/vm_unix.c:86: dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent)

Verdict

Source-confirmed at sys/vm/vm_unix.c:86: dead signedness check if(incr<0) in sys_sbrk (incr is unsigned; latent)