sk_init only handles ENOBUFS from sk_init_rx_ring, brings interface up with partial ring on other errors
Summary
sk_init at if_sk.c:2712: if(sk_init_rx_ring(sc_if)==ENOBUFS). sk_init_rx_ring returns raw bus_dmamap_load_mbuf_segment error (EFBIG/ENOMEM/EFAULT not ENOBUFS). Non-ENOBUFS error -> init proceeds, starts RX BMU at :2738. Zeroed descriptors k..255 have sk_data_lo/hi=0 -> NIC DMAs received frames to phys 0. Requires memory pressure to trigger non-ENOBUFS failure. Fix: check any error, not just ENOBUFS.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1277 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 944 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 640 B | view raw |
DF-1277 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
sk_init only handles ENOBUFS from sk_init_rx_ring, brings interface up with partial ring on other errors
Source Location
sys/dev/netif/sk/if_sk.c:2712-2717
Verdict
Source-confirmed: sk_init only handles ENOBUFS from sk_init_rx_ring, brings interface up. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
sk_init at if_sk.c:2712: if(sk_init_rx_ring(sc_if)==ENOBUFS). sk_init_rx_ring returns raw bus_dmamap_load_mbuf_segment error (EFBIG/ENOMEM/EFAULT not ENOBUFS). Non-ENOBUFS error -> init proceeds, starts RX BMU at :2738. Zeroed descriptors k..255 have sk_data_lo/hi=0 -> NIC DMAs received frames to phys 0. Requires memory pressure to trigger non-ENOBUFS failure. Fix: check any error, not just ENOBUFS.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: sk_init only handles ENOBUFS from sk_init_rx_ring, brings interface up with partial ring on other errors. Fixed to !=0. HW-gated.
Verified recommended fix
Source-confirmed: sk_init only handles ENOBUFS from sk_init_rx_ring, brings interface up with partial ring on other errors. Fixed to !=0. HW-gated.
Verdict
Source-confirmed: sk_init only handles ENOBUFS from sk_init_rx_ring, brings interface up with partial ring on other errors. Fixed to !=0. HW-gated.
No comments yet.