DF-2861
_sglist_append_buf() ignores pmap_extract() failure — unmapped user addresses become physical-page-0 DMA segments instead of EFAULT (dead paths; upstream parity)
| Field | Value |
|---|---|
| ID | DF-2861 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-755 Improper Handling of Exceptional Conditions |
| File | sys/kern/subr_sglist.c |
| Lines | 125-130, 153-156 |
| Area | kern |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
For user address ranges (pmap != NULL), paddr comes from pmap_extract(),
which returns 0 for unmapped addresses. The value is never checked: an
invalid user buffer appends a segment with ss_paddr=0, so a DMA
consumer would transfer to/from physical page 0 rather than fail with
EFAULT. Only reachable via sglist_append_user/append_uio/consume_uio —
all with zero in-tree callers; FreeBSD HEAD likewise does not check.
Fix: if (paddr == 0) { pmap_extract_done(handle); return (EFAULT); }
after each extract (callers already roll back on error).
Timeline
- 2026-09-02 Discovered during pass-2 audit of subr_sglist.c (GLM 5.3).
No comments yet.