DF-0806 — dirfs_readlink off-by-one heap overflow + OOB read

Verdict

REPRODUCED (deterministic harness) — 1-byte heap overflow (CWE-787) AND 1-byte OOB read (CWE-125) confirmed in dirfs_readlink. The fix.diff (kmalloc(uio_resid+1) + uiomove(buf, nlen)) is compile-validated and harness-validated; a live-kernel boot test is not_testable because dirfs is vkernel-only (not compiled into the running X86_64_GENERIC host kernel and no vkernel runs on this guest).

The bug — line-by-line (sys/vfs/dirfs/dirfs_vnops.c)

1328:  buf = kmalloc(uio->uio_resid, M_DIRFS_MISC, M_WAITOK | M_ZERO);
1329:  nlen = readlinkat(pathnp->dn_fd, dnp->dn_name, buf, uio->uio_resid);
1330:  if (nlen == -1 ) {
1331:      error = errno;
1332:  } else {
1333:      error = uiomove(buf, nlen + 1, uio);   // reads nlen+1 bytes
1334:          buf[nlen] = '\0';                   // writes at index nlen

• :1328 allocates exactly N = uio->uio_resid bytes (M_ZERO is cosmetic for the overflow; it only zeroes the N allocated bytes, not byte N).
• :1329 readlinkat(..., buf, uio->uio_resid) — POSIX returns up to bufsiz; when the symlink target length ≥ N it returns nlen == N (the buffer is exactly full, no room for a terminator).
• :1334 buf[nlen] = '\0' ⇒ buf[N] = '\0' — writes 1 byte past the N-byte allocation ⇒ CWE-787 off-by-one heap overflow (OOB write).
• :1333 uiomove(buf, nlen + 1, uio) ⇒ copies N+1 bytes from an N-byte buffer ⇒ CWE-125 1-byte OOB read (the extra byte is also leaked to the user via the UIO_READ uio).

uio->uio_resid is the raw user-supplied count, unclamped: sys/kern/vfs_syscalls.c:3211 auio.uio_resid = count; (kern_readlink), where count is the user's readlink(path, buf, count) argument. There is no upper bound or validation, so any N ≥ 1 is reachable.

Reachability on this guest (why a harness)

dirfs is vkernel-only. Confirmed: - grep -c dirfs /usr/src/sys/conf/files ⇒ 0 (not in the host-kernel file list). - grep -c dirfs /usr/src/sys/platform/vkernel64/conf/files ⇒ 3 (dirfs_vnops.c, dirfs_vfsops.c, dirfs_subr.c as optional dirfs). - /boot/kernel/dirfs* ⇒ does not exist; kldstat | grep dirfs ⇒ none. - The running kernel is 6.5-DEVELOPMENT #0 (X86_64_GENERIC) which does not include options DIRFS.

dirfs is a pass-through filesystem that runs inside a vkernel (a userspace process that simulates a kernel). There is no vkernel running on this guest, and even building+booting one and mounting a dirfs inside it to reach dirfs_readlink is not feasible in this single-tenant host-kernel guest. Per the finding's authorization and the spec's dead-code/latent-bug clause (DF-0594/0616/0281 precedent), the deterministic harness is the accepted proof: it transcribes the exact buggy operations (:1328–:1334) with a guard-page allocator so any access to buf[N] faults deterministically.

Reproduction — harness (harness.c)

./harness exercises N ∈ {16, 32, 64, 128, 256} (kmalloc buckets). For every N:

VULNERABLE dirfs_readlink transcription (kmalloc(N), nlen=N):
  line 1334 buf[nlen]='\0'  : FAULT (1-byte heap overflow / OOB WRITE confirmed)
  line 1333 uiomove(buf,N+1) : FAULT (1-byte OOB READ confirmed)
FIXED transcription (kmalloc(N+1), uiomove(buf,nlen)):
  buf[nlen]='\0'            : no fault (in-bounds)
  uiomove(buf,N)            : no fault (in-bounds)
=> BUG PRESENT (OOB detected); FIX VALID (no OOB)

Result over 3 runs is byte-identical (guard-page detection is deterministic). Full output: run.log; stress runs: run.stress.log.

Impact ceiling

• 1-byte heap overflow writing '\0' one past a kmalloc(N) buffer (M_DIRFS_MISC bucket), plus a 1-byte OOB read leaked to userspace via the uiomove UIO_READ.
• The write value is a fixed 0x00 (NUL), not fully attacker-controlled.
• On a vkernel deployment, this corrupts the vkernel process's heap (dirfs code runs in the vkernel userspace process). It is a vkernel-heap corruption primitive, not a host-kernel corruption.
• This guest runs the host kernel with no dirfs, so the primitive is not live-reachable here; the harness is the proof at the object/transcription level. The honest demonstrated impact is the confirmed memory-corruption primitive (1-byte OOB write + 1-byte OOB read); escalation to uid=0 was neither attempted nor claimed because the vulnerable code path is not reachable on this guest's default kernel.
• INVARIANTS (ON on GENERIC) would, in a vkernel build with INVARIANTS, catch cross-slab grooming via the kern_slaballoc.c magic/poison checks; on this guest that is moot (dirfs absent).

Exploit chain

none (not applicable). This is a vkernel-only memory-corruption primitive that is not reachable on this guest's default X86_64_GENERIC kernel, so there is no userspace uid=0 chain to develop or demonstrate here. The realistic ceiling is the confirmed 1-byte heap overflow + 1-byte OOB read, characterized via the deterministic harness.

The fix — fix.diff

-   buf = kmalloc(uio->uio_resid, M_DIRFS_MISC, M_WAITOK | M_ZERO);
+   buf = kmalloc(uio->uio_resid + 1, M_DIRFS_MISC, M_WAITOK | M_ZERO);
    nlen = readlinkat(pathnp->dn_fd, dnp->dn_name, buf, uio->uio_resid);
    if (nlen == -1 ) {
        error = errno;
    } else {
-       error = uiomove(buf, nlen + 1, uio);
+       error = uiomove(buf, nlen, uio);
        buf[nlen] = '\0';

• Allocate N+1 bytes so buf[N] (the NUL terminator at index nlen==N) is in-bounds.
• uiomove(buf, nlen, uio) copies exactly nlen bytes — no OOB read. The NUL is not part of the data returned to userspace by readlink() (POSIX readlink does not NUL-terminate); the original nlen+1 was the bug, copy the actual link length only.

The harness "FIXED transcription" path proves the logic closes the OOB deterministically across all tested bucket sizes (no fault on buf[N] access with the N+1 allocation).

Fix validation (Phase 8)

• git apply --check / patch --dry-run on a clean /usr/src tree ⇒ RC=0 (applies cleanly).
• Patched source reads correctly: :1328 ⇒ kmalloc(uio->uio_resid + 1, ...); :1333 ⇒ uiomove(buf, nlen, uio).
• Compile neutrality proven: dirfs is optional dirfs only in sys/platform/vkernel64/conf/files, so a VKERNEL64_DIRFS config was generated (config -d …/compile/VKERNEL64_DIRFS VKERNEL64_DIRFS). Compiling the patched dirfs_vnops.o standalone fails on M_WAITOK/M_ZERO/ uiomove/kmalloc/kfree undeclared — but compiling the UNPATCHED dirfs_vnops.o fails with the identical error set at the identical lines (653, 1057, 1078, 1186, 1250, 1328). dirfs_vnops.c simply omits the <sys/malloc.h>/<sys/uio.h> includes that its sibling dirfs_vfsops.c has, so it does not stand alone outside the full vkernel build. The sibling dirfs_vfsops.o did compile cleanly (190 KB) in the same vkernel build environment. Conclusion: the fix introduces zero new compile errors (patched ≡ unpatched); the residual standalone failure is a pre-existing missing-transitive-include issue in dirfs_vnops.c, unrelated to this fix.
• Live boot test: not_testable — dirfs is not in the host kernel and no vkernel runs on this guest, so the readlink→dirfs_readlink path cannot be exercised on a live kernel here. The harness transcription is the deterministic proof that the fix closes the OOB.

PoC changes

• harness.c (pre-existing from the aborted run) — kept as-is; it is a correct deterministic transcription of :1328–:1334 with a guard-page allocator. No source changes were needed; it builds and runs cleanly.
• build.sh / run.sh (pre-existing) — kept as-is.
• fix.diff (pre-existing) — confirmed correct (git apply --check RC=0, compile-neutral, harness-validates).
• Regenerated: build.log, run.log, run.stress.log, env.txt, fix_run.log (full evidence of this run).

How to reproduce

ssh dfbsd-maxx   # unprivileged (uid 1001)
cd poc/DF-0806
./build.sh && ./run.sh
# expected: "BUG CONFIRMED + FIX VALIDATED" with FAULT lines for the
#           vulnerable transcription and "no fault (in-bounds)" for the fixed.