fairq_add_queue()/fairq_class_create() lack a lower-bound check on priority — negative pri is an OOB write below pif_classes[] (DF-0444 twin; currently typed-away by u_int8_t pf_altq.priority)
Summary
fairq_add_queue() validates only the upper bound; a negative pri would index pif_classes[pri] OOB - read and WRITE of a heap pointer below the array at fairq_class_create. Identical defect family to DF-0444 (rmc_newclass). Currently unreachable: pf_altq.priority is u_int8_t so the kernel-side field cannot be negative, and pfctl bounds to <=255 which the >= FAIRQ_MAXPRI(8) check rejects. Latent heap OOB write for any future in-kernel caller passing an int priority. Fix: two-sided bound check. [VERIFIED pass2: one-sided priority bound before classes read-write confirmed typed away by u_int8_t today; two-sided bounds compiled]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3412 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 241 B | ↓ raw | |
| fix.diff | — | 344 B | view raw | |
| manifest.json | — | 354 B | view raw | |
| verdict.json | — | 1.6 KB | view raw |
DF-3412 evidence pack
What
fairq_add_queue lacks a lower-bound check on priority (DF-0444 twin)
Verdict
status=not_reproduced impact=none confidence=certain
See VERDICT.md for the full narrative and fix.diff for the verified fix.
Fix verification
not_testablefix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)
Confirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff
PoC changes
n/a - typed-away today
Verified recommended fix
two-sided priority bound checks in fairq_add_queue (and keep the class_create check two-sided)
Verdict
Line-accurate confirmation; no runtime demonstration attempted because the defect is typed away (pf_altq.priority is u_int8_t and pfctl bounds to <=255, so the kernel-side field cannot be negative; fairq_add_queue checks only a->priority >= FAIRQ_MAXPRI at altq_fairq.c:230 before pif_classes[a->priority] is read and WRITTEN, and fairq_class_create only pri > pif_maxpri at :439). Identical family to DF-0444 (rmc_newclass OOB). A future in-kernel caller passing an int priority gets a heap OOB write below pif_classes[]. Fix adds two-sided bounds; compiled in the F40FIX build (ALTQ_FAIRQ in kernel).
No comments yet.