DF-2757
vn_stat's MNT_NOSYMFOLLOW symlink-mode adjustment is dead code and reads sb->st_mode before it is ever initialized
| Field | Value |
|---|---|
| ID | DF-2757 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-456 / CWE-670 |
| File | sys/kern/vfs_vnops.c |
| Lines | 882-886 (publication :897) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
In vn_stat's VLNK case the code does sb->st_mode &= ~ACCESSPERMS /
sb->st_mode |= ACCESSPERMS — reading sb->st_mode before any
assignment (the only write is the unconditional sb->st_mode = mode;
after the switch). The uninitialized-stack read is computed-then-
discarded so nothing leaks, but the intended 0777/0000 cosmetic for
symlinks never takes effect: every symlink stat reports the inode's
raw va_mode regardless of MNT_NOSYMFOLLOW.
Recommended fix
Apply the adjustment to mode before publication (or drop the dead
branches).
Timeline
- 2026-08-30 Discovered during pass-2 audit of vfs_vnops.c (GLM 5.3).
No comments yet.