DF-2860
sglist_consume_uio() swallows all errors and unconditionally returns 0 — EFBIG/EFAULT indistinguishable from full success (dead code; upstream parity)
| Field | Value |
|---|---|
| ID | DF-2860 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-754 Improper Check for Exceptional Conditions |
| File | sys/kern/subr_sglist.c |
| Lines | 417, 423-426 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
The loop breaks on _sglist_append_buf() failure but the function
returns 0 in every path, discarding error. When the failure happens
with done==0 (first page, e.g. EFBIG on an already-full list), the
caller sees success with zero progress; a caller looping until resid is
consumed spins forever. Zero in-tree callers (beyond DF-0097/0098's
defects in the same dead function); identical behavior in FreeBSD HEAD.
Fix: return error whenever done==0 (or EFBIG→0 documented).
Timeline
- 2026-09-02 Discovered during pass-2 audit of subr_sglist.c (GLM 5.3).
No comments yet.