DF-2825
Negative l_len rejected with EINVAL instead of the POSIX [l_start+l_len, l_start-1] semantics
| Field | Value |
|---|---|
| ID | DF-2825 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-20 (standards-conformance deviation, fail-closed) |
| File | sys/kern/kern_lockf.c |
| Lines | 230-231 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
lf_advlock() returns EINVAL for fl->l_len < 0, while POSIX.1-2008 (and FreeBSD, and Linux) interpret negative lengths as the range [l_start+l_len, l_start-1]. Portable applications using backward locks fail closed on DragonFly. Observed on the guest: F_SETLK(start=10, len=-5) → EINVAL where POSIX expects the lock [5,9]. No memory-safety impact. Fix: convert instead of reject (row diff).
Timeline
- 2026-08-31 Discovered during pass-2 audit of kern_lockf.c (GLM 5.3).
No comments yet.