DF-0778 — ufs_readlink OOB read / panic via i_size truncation to int

Status: REPRODUCED (Mode A leak + Mode B panic) · FIX VALIDATED Severity: Medium · CWE-197 (Integer Truncation) / CWE-125 (OOB Read) / CWE-200 (Info Leak)

What this proves

ufs_readlink() truncates the on-disk uint64 i_size of a symlink inode to a signed int and feeds it to uiomove() against the 48-byte inline i_shortlink buffer with no upper bound. A crafted UFS/FFS image whose symlink inode has di_blocks==0 and a malicious di_size produces, via an unprivileged readlink() after the image is mounted:

• Mode A (di_size=200): OOB read of 152 bytes past the inode into adjacent kernel slab — info leak incl. kernel KVA pointers (KASLR bypass).
• Mode B (di_size=0x80000000): isize becomes INT_MIN, sign-extends to ~2^63 as a size_t; a sufficiently large user buffer makes uiomove page-fault in kernel mode → kernel panic (vm_fault: fault on stack guard in ufs_readlink+0x42).

Files

How to reproduce

# 1. (root on guest) craft the malicious UFS1 image — Mode A or B
ssh dfbsd '/root/craft_image.sh 200'      # Mode A = di_size 200 (OOB leak)
ssh dfbsd '/root/craft_image.sh modeB'    # Mode B = di_size 0x80000000 (panic)

# 2. (unprivileged) trigger
ssh dfbsd-maxx '/home/maxx/trigger_readlink /mnt/test/mylink'
ssh dfbsd-maxx '/home/maxx/trigger_readlink_big /mnt/test/mylink 16777216'   # Mode B

Preconditions

• An admin mounts the crafted UFS/FFS image (vfs.usermount=0 → root mount; realistic: downloaded disk image, USB volume, attached storage).
• Then any unprivileged local user triggers via readlink().

The fix (validated)

int isize → int64_t isize; only use the inline i_shortlink when 0 <= isize <= UFS1_MAXSYMLINKLEN. See fix.diff and VERDICT.md.

DF-0778 — ufs_readlink OOB read / panic via i_size truncation to int

Verdict: REPRODUCED (both modes) + FIX VALIDATED

ufs_readlink() (sys/vfs/ufs/ufs_vnops.c:1740-1747) declared int isize, assigned isize = ip->i_size (uint64 → signed int truncation), and fed it straight to uiomove(i_shortlink, isize, uio) with no upper bound on the 48-byte i_shortlink (= di_db) buffer. A crafted UFS/FFS image whose symlink inode has di_blocks == 0 (inline shortlink) and a malicious di_size turns this into an OOB read (info leak) or a kernel panic (DoS), triggered by an unprivileged readlink() after an admin mounts the image.

Reachability / threat model

Mount-time filesystem-image parsing (root mounts a crafted FFS image — e.g. a downloaded disk image, USB stick, or attached volume). Once mounted, any unprivileged local user can trigger the bug with readlink() on the crafted symlink. vfs.usermount=0 on this guest, so the mount itself needs root — but that is a realistic admin action, and the exploitation is fully unprivileged. This matches the Medium severity (local, requires crafted image).

The two failure modes (both reproduced live)

Mode A evidence (leak, guest survives)

readlink returned 200 bytes (shortlink buffer is only 48)
--- bytes after offset 48 (past i_shortlink): 152 ---
LEAKED_KERNEL_PTRS=5
…3033a38d 00f8ffff…  = 0xfffff8008da33330  (KVA)

Full hexdump across 3 runs in leak_sample.txt. Stable per-mount (rest of the on-disk inode struct + its slab neighbours).

Mode B evidence (panic)

panic: vm_fault: fault on stack guard, addr: 0xfffff80090204000
--- trap 000000000000000c ---
std_copyout() at std_copyout+0x15a
ufs_readlink() at ufs_readlink+0x42        <-- the bug
Debugger("panic")

Full trace in panic.txt.

Root-cause trace (path:line, all confirmed)

1. sys/vfs/ufs/ufs_vnops.c:1740 — int isize; (signed 32-bit).
2. :1742 — isize = ip->i_size; silently narrows the uint64 i_size to signed int. i_size is int64_t (sys/vfs/ufs/inode.h), the on-disk di_size is uint64_t (sys/vfs/ufs/dinode.h:76).
3. :1743-1744 — if ((isize < mnt_maxsymlinklen) || (di_blocks == 0)). mnt_maxsymlinklen is copied verbatim from the attacker-controlled superblock with no validation (sys/vfs/ufs/ffs_vfsops.c:504 mp->mnt_maxsymlinklen = fs->fs_maxsymlinklen). The di_blocks == 0 OR branch is taken for every inline symlink regardless of isize, so even a huge/negative isize reaches uiomove.
4. :1745 — uiomove((char *)ip->i_shortlink, isize, ap->a_uio); i_shortlink overlays di_db (sys/vfs/ufs/inode.h:126 #define i_shortlink i_din.di_shortlink → sys/vfs/ufs/dinode.h:112 #define di_shortlink di_db), which is ufs_daddr_t[12] = 48 bytes (UFS1_MAXSYMLINKLEN = (12+3)*4 = 60 includes the indirect array, sys/vfs/ufs/dinode.h:114). The int isize is implicitly converted to size_t for uiomove's 2nd arg → negative isize becomes ~2^63.

The inode is read verbatim from disk with no di_size validation (sys/vfs/ufs/ffs_vfsops.c:1147 ip->i_din = *((ufs1_dinode*)bp->b_data+...)), so a crafted image controls di_size and di_blocks directly.

Escalation

None. This is a read-only primitive (OOB read / info leak / DoS panic) — no write capability, so there is no privilege-escalation chain. The realistic impact ceiling is kernel heap info leak (KASLR bypass / pointer disclosure) + local DoS (panic) from an unprivileged user after a crafted-image mount. Correctly classified Medium.

The fix (fix.diff, validated)

Use int64_t isize (no truncation) and only trust the inline i_shortlink buffer when 0 <= isize <= UFS1_MAXSYMLINKLEN. A corrupted/huge di_size falls through to VOP_READ, which returns EINVAL/reads zero blocks safely (di_blocks==0 → no data) instead of OOB-reading the inline buffer.

-   int isize;
-   isize = ip->i_size;
-   if ((isize < vp->v_mount->mnt_maxsymlinklen) ||
-       (ip->i_din.di_blocks == 0)) {   /* XXX - for old fastlink support */
-       uiomove((char *)ip->i_shortlink, isize, ap->a_uio);
+   int64_t isize;  /* was: int -- ip->i_size is uint64_t */
+   isize = ip->i_size;
+   if (isize >= 0 && isize <= UFS1_MAXSYMLINKLEN &&
+       ((isize < vp->v_mount->mnt_maxsymlinklen) ||
+        (ip->i_din.di_blocks == 0))) {   /* XXX - for old fastlink support */
+       uiomove((char *)ip->i_shortlink, (size_t)isize, ap->a_uio);

Fix validation (Phase 8) — single-fix kernel built + booted

• Baseline #0 (unpatched, 6.5-DEVELOPMENT #0 Jul 2): Mode A leaks 152 bytes OOB; Mode B (16 MB buf) panics (vm_fault in ufs_readlink+0x42).
• Patched #1 (6.5-DEVELOPMENT #1 Fri Jul 10 02:56:28, sha256 e024132b…, single-fix kernel): Mode A → readlink: Invalid argument (0 bytes leaked); Mode B (16 MB buf) → readlink: Invalid argument, guest stays up, no panic (3/3 runs). No regression: a normal 46-byte short symlink reads correctly (readlink → target, rc=0).

See fix_build.log (full kernel build, rc=0) and fix_run.log (before/after contrast).

How to reproduce

# root: build a crafted UFS1 image, patch the symlink inode, mount it
ssh dfbsd '/root/craft_image.sh 200'      # Mode A (leak); 'modeB' for panic

# unprivileged user: trigger
ssh dfbsd-maxx '/home/maxx/trigger_readlink /mnt/test/mylink'

build.sh compiles the trigger; run.sh drives both modes; craft_image.sh (root) creates the crafted FFS image via newfs + fsdb chlen.