DF-2325 — signed left-shift UB in pci_add_map BAR sizing at ln2size 31 — evidence pack

Finding: sys/bus/pci/pci.c:2644,2650 — count = 1 << ln2size; and end = base + (1 << ln2size) - 1; shift a signed int literal into the sign bit at ln2size 31 (2 GiB BAR) — C11 6.5.7p4 UB — and the sign-extended result poisons the u64 resource range.

Verdict (short)

REPRODUCED on the stock INVARIANTS kernel through the verbatim pci_add_map/pci_mapsize: a fabricated BAR decoding 2 GiB yields count=0xffffffff80000000, end=0xffffffffbfffffff (expected 0x80000000 / 0xbfffffff); controls at 1 GiB and 64 KiB are correct; the REAL resource_list_add accepts the garbage range into the device list. Kernel CFLAGS (-fno-strict-overflow, no -fwrapv) make the wrap deterministic on this build (cc 8.3). Impact is a permanently broken BAR reservation for 2 GiB-BAR devices (correctness/availability; no memory-safety effect). Fix A/B validated: 1ULL shifts produce correct values at 31 with lower sizes unchanged.

Rig

Shared with DF-2323 (same verbatim-interposition kernel-compiled harness; verbatim sha256 gates; see DF-2323/rig). BAR sizing probe emulated at the interposed PCIB_WRITE/READ_CONFIG boundary; computed (start,end,count) captured at the interposed resource_list_add.

Reproduce

sh rig/run_2325.sh — see rig/bar_capture.log (baseline) and rig/fixed_runs.log (fixed kernel, DFPCIPF).

Files

• VERDICT.md — narrative + value table + CFLAGS determinism
• rig/bar_capture.log — baseline captures (stock kernel)
• rig/fixed_runs.log — fixed-kernel captures
• rig/cflags_evidence.txt — -fno-strict-overflow, no -fwrapv
• rig/ — shared harness + fix.diff
• env.txt, manifest.json, verdict.json

DF-2325 — signed 1 << ln2size UB in BAR sizing at ln2size 31 — VERDICT

status: reproduced / impact: none at the kernel-memory-safety level (wrong computed resource range: count/end wildly wrong for a 2 GiB BAR; the bogus range is accepted into the resource list; no corruption demonstrated or claimed).

Line-accurate analysis (verified mechanically)

pci_add_map computes, with ln2size from the verbatim pci_mapsize (pci.c:451-466) driven by the BAR sizing probe:

    count = 1 << ln2size;            /* pci.c:2644 */
    ...
        end = base + (1 << ln2size) - 1;   /* pci.c:2650 */

count/end are pci_addr_t (uint64_t, pcivar.h:48). At ln2size == 31 (2 GiB BAR: sizing readback 0x80000000) the int literal 1 << 31 overflows into the sign bit — C11 6.5.7p4 UB. On this kernel build (cc 8.3, -O2 -fno-strict-overflow, no -fwrapv — rig/cflags_evidence.txt) the shift compiles to a plain shl and wraps deterministically: (int)0x80000000 -> conversion to uint64_t SIGN-EXTENDS.

Observed through the verbatim pci_add_map + interposed resource_list_add (the REAL resource_list_add was also called in the realadd variant — it accepted the range into the list):

The wrong count is ~2^64-2^31 and end lands 4 GiB above the 32-bit space after wrap — the rman reservation for the BAR can never succeed with such a count (and the range entry is nonsense); downstream the BAR is simply never correctly reserved/mapped (device malfunction), it is not a memory-corruption primitive. Determinism note: the shipped CFLAGS include -fno-strict-overflow (signed wrap is two's-complement in this build), and gcc emits shl regardless — the mis-sizing is deterministic on this kernel, while remaining UB per the standard (gcc's shift-into-sign-bit is exactly the case -fwrapv-style flags make reproducible in practice).

Threat model: malicious PCI device decoding a 2 GiB BAR (AV:P); ln2size 31 is also reachable with real 2 GiB-BAR hardware (correct sizing of a perfectly legitimate device is also broken — this is a correctness bug first).

Fix (validated A/B)

rig/fix.diff DF-2325 hunk:

-   count = 1 << ln2size;
+   count = 1ULL << ln2size;
...
-       end = base + (1 << ln2size) - 1;
+       end = base + (1ULL << ln2size) - 1;

A/B on DFPCIPF: ln2size 31 now computes count=0x80000000, end=0xbfffffff (correct); ln2size 16/30 unchanged (0x10000/0x40000000) — rig/fixed_runs.log.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)