pipe_size sysctl lacks power-of-two validation: non-pow2 buffer size silently aliases FIFO slots (in-bounds cross-process data corruption) on misconfigured systems

Summary

The FIFO maps logical byte counters to physical slots with rindex & (size-1) / windex & (size-1), which is modulo only when size is a power of two. pipespace() page-aligns and clamps size to [16384, 1MB] but never validates the power-of-two property, and the writable sysctl kern.pipe.size accepts any int (e.g. 20480). With a non-pow2 size two distinct live offsets map to the same slot (e.g. 0x5000 & 0x4FFF == 0x4000), so a writer overwrites unread data — silent data corruption between the pipe's users. All accesses remain in-bounds, so integrity-only; requires a privileged sysctl write (an administrator misconfiguration, not attacker-reachable). Sibling FreeBSD code guards this with a power-of-two check.

Recommended fix

In pipespace(), after the clamps: if (size & (size - 1)) size = 1UL << (fls(size) - 1); if (size < 16384) size = 16384; and optionally guard the sysctl writer with the same check.

Timeline

• 2026-08-30 Discovered during pass-2 audit of sys_pipe.c (GLM 5.3).