DF-2767
journal_status_vfs_journal index filter over-returns: requesting status for index k returns journals 0..k instead of only k
| Field | Value |
|---|---|
| ID | DF-2767 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-841 Improper Behavioral Consistency |
| File | sys/kern/vfs_jops.c |
| Lines | 476-478 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
The numeric-index filter is if (info->index < index) continue; — it
skips only journals positioned ABOVE the requested index, so a request
for journal #k returns records 0..k (the intent was clearly
info->index != index → continue). Pure logic bug in a root-only
status path; no memory-safety impact.
Recommended fix
Change the predicate to if (info->index != index) continue;
Timeline
- 2026-08-30 Discovered during pass-2 audit of vfs_jops.c (GLM 5.3).
No comments yet.