DF-0108 — Unvalidated d_secsize in writedisklabel

Verdict: REPRODUCED (panic/DoS on default GENERIC) + FIX VALIDATED. Impact: panic (root/operator-only DoS; no unpriv escalation). Privilege: root/operator only — DIOCWDINFO32 needs FWRITE on a root:operator 0640 slice device node. maxx (not in operator) cannot reach it.

Build & run

cc -o poc_secsize poc_secsize.c      # build.sh
# as root/operator:
rm -f /root/scratch.img
dd if=/dev/zero of=/root/scratch.img bs=1m count=64
vnconfig -c -s labels /dev/vn0 /root/scratch.img
./poc_secsize /dev/vn0s0              # run.sh

Expected

• Unpatched GENERIC kernel (#0, INVARIANTS ON): kernel panic at subr_disklabel32.c:336 — KKASSERT "d_secsize <= b_bufsize". The ssh session dies; the panic is captured in the serial log (dfbsd-qemu/boot.log).
• Patched kernel (#1): ioctl returned rc=-1, errno=22 (Invalid argument), guest stays up.

Files

DF-0108 — Unvalidated d_secsize in l32_writedisklabel

Verdict

REPRODUCED (panic/DoS on default GENERIC) + FIX VALIDATED. The bug is real: d_secsize from a user-supplied disklabel32 reaches l32_writedisklabel without validation, and on the GENERIC kernel (INVARIANTS ON) the KKASSERT at subr_disklabel32.c:336 fires as a kernel panic. The single-fix kernel (fix.diff) returns EINVAL instead and the panic is gone (3/3 clean runs).

Privilege boundary: root/operator-only — there is no unprivileged→root escalation. DIOCWDINFO32 requires the slice device open FWRITE, and slice device nodes are root:operator mode 0640. The audit user maxx (uid 1001, not in operator) cannot trigger it. This is a root→kernel hardening gap.

Mechanism (confirmed, path:line at each hop)

1. Attacker opens a disk slice device (e.g. /dev/vn0s0) O_RDWR and issues ioctl(fd, DIOCWDINFO32, &crafted_label) — requires root/operator (subr_diskslice.c:583 checks flags & FWRITE; device nodes are root:operator 0640).

2. diskioctl() (subr_disk.c:1202) → dsioctl() (subr_diskslice.c:650-670). The DIOCWDINFO path first calls DIOCSDINFO32 internally, which invokes l32_setdisklabel (subr_disklabel32.c:250).

3. l32_setdisklabel validates magic, checksum, RAW_PART offset, secperunit, and each partition size — but NOT d_secsize (subr_disklabel32.c:264-314). The crafted label (valid magic/checksum, d_secsize = 0x200000 = 2 MiB, RAW_PART.p_offset = 0) passes all checks and is installed in-core.

4. Back in dsioctl, ops->op_writedisklabel(dev, ssp, sp, sp->ds_label) is called (subr_diskslice.c:670) → l32_writedisklabel.

5. l32_writedisklabel (subr_disklabel32.c:335-340): c bp = getpbuf_mem(NULL); /* :335 */ KKASSERT((int)lp->d_secsize <= bp->b_bufsize); /* :336 PANIC */ bp->b_bio1.bio_offset = (off_t)LABELSECTOR32 * lp->d_secsize; ... bp->b_bcount = lp->d_secsize; /* :340 */ bp->b_bufsize == MAXPHYS == 128 KiB (vm/vm_pager.c:391 initpbuf). With d_secsize = 2 MiB > 128 KiB, the KKASSERT fails. On GENERIC (INVARIANTS ON, sys/sys/systm.h:94-101) KKASSERT expands to a panic(); on a production kernel (INVARIANTS OFF, systm.h:117-118) it is a no-op and the oversized b_bcount flows to the device strategy routine.

Observed impact

• GENERIC kernel (#0, INVARIANTS ON — the default): immediate kernel panic at subr_disklabel32.c:336. Reproduced 2× from independent vm.sh reset with-src boots, identical signature. This is a DoS (root can already reboot the box, so the panic itself is not a privilege gain).

• Production kernel (INVARIANTS OFF, non-default): the KKASSERT is skipped and bp->b_bcount = d_secsize (2 MiB) exceeds the pbuf's b_bufsize (128 KiB) backing KVA. The oversized transfer reaches the device strategy routine. Whether this corrupts memory depends on the driver — most dev_dstrategy paths clamp b_bcount or use separate DMA mapping. This is a potential memory-corruption primitive, but only on the non-default noinv-class kernel, and only reachable by root/operator.

Exploit chain / escalation

None — root/operator-only path (valid hard blocker per Phase 6). DIOCWDINFO32 requires FWRITE on a root:operator 0640 device node (subr_diskslice.c:583, id maxx ⇒ groups=1001(maxx) only). An unprivileged user cannot cross the privilege boundary to reach this code. No unprivileged path was found (vnconfig/mdconfig/devfs rules all gate on root). Root→kernel is game-over by definition; this is a hardening gap, not a privesc. No exploit.c/chain.c was authored because there is no unprivileged victim to escalate against.

PoC changes

• Created poc_secsize.c (the finding shipped no PoC source — only a scaffold reference). The PoC builds a valid disklabel32 (correct DISKMAGIC32, dkcksum32==0, RAW_PART.p_offset==0, small partition sizes so l32_setdisklabel accepts it) with the hostile field d_secsize = 0x200000 (2 MiB ≫ MAXPHYS). It uses the header-provided dkcksum32() static inline (not a redefinition) and d_type=0 (the DTYPE_* enum is not exposed in the userland header).
• Uses a scratch vn-backed device (/dev/vn0s0 on a 64 MiB zero image) so the boot disk is never at risk.

Fix (fix.diff — supersedes the finding's proposal)

The finding's proposed fix places the check after getpbuf_mem(NULL), which would leak the pbuf on the error path (relpbuf at :395 is skipped by an early return). My fix places the validation before getpbuf_mem:

if (lp->d_partitions[RAW_PART].p_offset != 0)
    return (EXDEV);         /* not quite right */

/* Validate d_secsize before allocating the pbuf ... */
if (lp->d_secsize < DEV_BSIZE || lp->d_secsize > MAXPHYS)
    return (EINVAL);

bp = getpbuf_mem(NULL);
KKASSERT((int)lp->d_secsize <= bp->b_bufsize);   /* now always true for user input */

• DEV_BSIZE (512) lower bound rejects d_secsize == 0 (which would also wrap the loop-bound pointer arithmetic at :360).
• MAXPHYS (128 KiB) upper bound equals bp->b_bufsize, matching the KKASSERT invariant but as a real return (EINVAL).
• Placed before getpbuf_mem → no pbuf leak.
• The KKASSERT is retained as a secondary invariant (now unreachable for user-supplied labels).

Fix validation (Phase 8)

fix.diff applies cleanly (patch -p1 Hunk #1 succeeded), the single-fix kernel compiles (nativekernel rc=0), boots as #1, and the identical PoC that panicked the baseline now returns EINVAL with the guest staying up.

Reproduce

./build.sh                 # cc -o poc_secsize poc_secsize.c
sudo ./run.sh              # sets up scratch /dev/vn0s0, runs the PoC
# unpatched: panic at subr_disklabel32.c:336 (check dfbsd-qemu/boot.log)
# patched:   "errno=22 (Invalid argument)", guest stays up