Multi-fragment RX frame truncation when total_len is exact multiple of MCLBYTES
Summary
re_rxeof at if_re.c:1209: m->m_len=total_len%MCLBYTES. When total_len is exact multiple of MCLBYTES (e.g. 4096): m_len=0. :1216 if(m_len<=ETHER_CRC_LEN) true -> frees last fragment (loses ~2044B), trims 4B from previous. m_pkthdr.len=4092 but chain only has 2044 bytes. Stack traverses NULL m_next -> panic or OOB read. LATENT: requires RE_JUMBO compiled (not default), RE_RxMaxSize>MCLBYTES. Remote on jumbo-configured NIC. Fix: if m_len==0 set m_len=MCLBYTES.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1336 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 978 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 409 B | view raw |
DF-1336 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Multi-fragment RX frame truncation when total_len is exact multiple of MCLBYTES
Source Location
sys/dev/netif/re/if_re.c:1209-1226
Verdict
Source-confirmed: Multi-fragment RX frame truncation when total_len is exact multiple of. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
re_rxeof at if_re.c:1209: m->m_len=total_len%MCLBYTES. When total_len is exact multiple of MCLBYTES (e.g. 4096): m_len=0. :1216 if(m_len<=ETHER_CRC_LEN) true -> frees last fragment (loses ~2044B), trims 4B from previous. m_pkthdr.len=4092 but chain only has 2044 bytes. Stack traverses NULL m_next -> panic or OOB read. LATENT: requires RE_JUMBO compiled (not default), RE_RxMaxSize>MCLBYTES. Remote on jumbo-configured NIC. Fix: if m_len==0 set m_len=MCLBYTES.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: if_re multi-fragment RX truncates m->m_len=total_len%MCLBYTES which is 0 when total_len is exact multiple, losing data. Fixed to use MCLBYTES when modulo==0. HW-gated.
Verified recommended fix
Source-confirmed: if_re multi-fragment RX truncates m->m_len=total_len%MCLBYTES which is 0 when total_len is exact multiple, losing data. Fixed to use MCLBYTES when modulo==0. HW-gated.
Verdict
Source-confirmed: if_re multi-fragment RX truncates m->m_len=total_len%MCLBYTES which is 0 when total_len is exact multiple, losing data. Fixed to use MCLBYTES when modulo==0. HW-gated.
No comments yet.