Signed integer overflow in delay tick computation produces negative/erratic delays for large user-supplied millisecond values
Summary
_init user-supplied delay string parsed by atoi64 (uint64_t) then narrowed into int tmp (:141) before tmp*hz/1000 computed in plain int arithmetic (:142). For millisecond values >=~21474837 (about 5.96h depending on hz=100) tmp*hz overflows signed int. Wrap yields negative di->delay which silently disables delay (callout fires immediately) or wildly incorrect large positive delay pinning buffers in queue indefinitely (memory growth). Negative delay propagates to dp->expire=ticks+di->delay and callout_reset negative to_ticks. [VERIFIED pass2: reproduced on real dmsetup - 5.96h delay completes in 12ms with internal -2147483 ticks, 42949673ms wraps to instant; int64 fix A/B-validated +2147483 ticks blocks as designed]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2438 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 376 B | ↓ raw | |
| VERDICT.md | — | 1.2 KB | ↓ raw | |
| build.sh | — | 143 B | view raw | |
| delaytime.c | — | 710 B | view raw | |
| env.txt | — | 254 B | view raw | |
| fix.diff | — | 564 B | view raw | |
| manifest.json | — | 761 B | view raw | |
| run.log | — | 790 B | view raw | |
| run.sh | — | 128 B | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-2438 -- evidence pack
Verdict: reproduced (reproduced=1, impact=dos, confidence=certain)
Build: make -C /usr/src/sys/dev/disk/dm/delay (module); fix build: patch -p1 < fix.diff && make
Run: dmsetup create + delaytime writes (see run.log)
See VERDICT.md for the full narrative, run.log/panic.txt for the decisive output, fix.diff for the post-verification fix.
DF-2438 VERDICT
Status: reproduced Impact: dos Confidence: certain
Signed overflow collapses user-configured delays, fully demonstrated on the real dmsetup path: control 500ms -> 502ms; 21474837ms (5.96h expected) completed in 12ms with dmsetup table showing the internal delay = -2147483 ticks; 42949673ms (11.9h) completed instantly (wrapped to 0 ticks). Fixed-module A/B validated: with the int64 fix the same 21474837ms table reports +2147483 ticks and the write blocks as designed, and normal delays still work.
Kernel references
Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Notes
hz=100 on this guest
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
root-configured dm-delay table with a large millisecond value silently disables the delay or shrinks it by orders of magnitude; other values pin bios in the queue for a bogus interval
Evidence (decisive lines)
run.log (three timings + kernel-internal table states, baseline and fixed)
PoC changes
none (real dmsetup + vn backing; fix.diff applied in-guest for the A/B)
Verified recommended fix
compute di->delay in int64 (tmp * (int64_t)hz / 1000) and reject values exceeding INT_MAX ticks
Verdict
Signed overflow collapses user-configured delays, fully demonstrated on the real dmsetup path: control 500ms -> 502ms; 21474837ms (5.96h expected) completed in 12ms with dmsetup table showing the internal delay = -2147483 ticks; 42949673ms (11.9h) completed instantly (wrapped to 0 ticks). Fixed-module A/B validated: with the int64 fix the same 21474837ms table reports +2147483 ticks and the write blocks as designed, and normal delays still work.
No comments yet.