DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2242

Right-shift operator truncates operand to 32 bits (LP64 porting bug)

Summary

db_shift_expr casts left operand of >> to (unsigned) (32-bit) before shifting instead of (unsigned long) (64-bit). On x86_64 db_expr_t is long (64-bit). Cast silently discards high 32 bits of operand. Expression 0x123456789abcdef0>>4 should yield 0x123456789abcdef but code computes (unsigned)0x123456789abcdef0=0x9abcdef0 then >>4=0x09abcdef assigned back 0x0000000009abcdef high dword silently lost. Classic LP64 porting bug original Mach code correct on ILP32 where unsigned==long never updated when db_expr_t became 64-bit. DDB-only privileged context operator can already read any kernel memory via examine. Wrong value computed for any right-shift whose operand exceeds 32 bits can mislead operator during debugging wrong address wrong memory examined misdiagnosed crash. No security impact correctness defect only.

Discussion (0)

No comments yet.