DF-0825 — nfs_getnickauth post-increment bug

Finding: nfs_getnickauth (sys/vfs/nfs/nfs_syscalls.c:1115-1119) has a post-increment bug that leaves auth_str pointing 4 bytes into the 8-byte kmalloc'd auth buffer instead of at its start.

How to reproduce

./build.sh   # builds the df0825_harness.ko KLD module in-guest
./run.sh     # loads the module; nfs_getnickauth is called with a planted nickname

Expected output

Unpatched (bug present, kernel #0):

DF-0825: auth_str = 0xfffff8008d680c84       ← off-by-4 (ends in 4)
DF-0825: auth_str[0..3] = 0xdeadbeef         ← nickname, NOT RPCAKN_NICKNAME
DF-0825: auth_str[4..7] = 0x00000000         ← OOB heap
DF-0825: *** BUG CONFIRMED ***

After kfree(auth_str), a deferred slab panic fires within ~30s:

panic: assertion "(((intptr_t)chunk ^ (intptr_t)z) & ZoneMask) == 0"
       failed in chunk_mark_free at kern_slaballoc.c:1675

Patched (fix applied, kernel #1):

DF-0825: auth_str = 0xfffff8008d382270       ← base (ends in 0)
DF-0825: auth_str[0..3] = 0x00000001         ← RPCAKN_NICKNAME ✓
DF-0825: auth_str[4..7] = 0xdeadbeef         ← nickname ✓
DF-0825: OK — auth_str points at allocation base (bug fixed)

No panic; guest stays alive.

Harness design

The KLD module (df0825_harness.c) constructs a minimal fake struct nfsmount with a nickname entry (uid 1001, nickname 0xDEADBEEF) and calls the real in-kernel nfs_getnickauth() function. It inspects where auth_str points and demonstrates: 1. auth_str is 4 bytes past the allocation base (the bug) 2. auth_str[0] = nickname instead of RPCAKN_NICKNAME 3. auth_str[4..7] reads 4 bytes OOB past the allocation (info leak) 4. kfree(auth_str) frees a non-base pointer → deferred slab corruption panic

Files

DF-0825 — nfs_getnickauth post-increment bug

Verdict: REPRODUCED — confirmed OOB heap read + deferred slab-corruption panic; fix VALIDATED

Bug mechanism (confirmed by source trace + live kernel harness)

Root cause: nfs_getnickauth() in sys/vfs/nfs/nfs_syscalls.c:1115-1119 has a classic post-increment bug. The code allocates an 8-byte buffer and writes two 4-byte XDR words using *nickp++, which advances nickp past the first word. It then assigns the post-increment pointer (not the base) to *auth_str:

nickp = (u_int32_t *)kmalloc(2 * NFSX_UNSIGNED, M_TEMP, M_WAITOK);  // P = base, 8 bytes
*nickp++ = txdr_unsigned(RPCAKN_NICKNAME);   // writes P[0..3], nickp → P+4
*nickp = txdr_unsigned(nuidp->nu_nickname);   // writes P[4..7], nickp stays P+4
*auth_str = (char *)nickp;                     // BUG: auth_str = P+4, not P
*auth_len = 2 * NFSX_UNSIGNED;                 // auth_len = 8

Consequence 1 — 4-byte OOB heap read (info leak): The caller nfs_request() (sys/vfs/nfs/nfs_socket.c:1233-1235) passes auth_str and auth_len=8 to nfsm_rpchead(). In the RPCAUTH_KERB4 branch (sys/vfs/nfs/nfsm_subs.c:195-211), bcopy(auth_str, info.bpos, i) copies 8 bytes starting at P+4 — i.e. P[4..7] (valid, the nickname) + P[8..11] (4 bytes past the 8-byte allocation = OOB kernel heap). These 4 OOB bytes are placed into the NFS RPC credential mbuf and transmitted to the NFS server.

Consequence 2 — kfree of non-base pointer → slab corruption → panic: After building the RPC header, nfs_request() at nfs_socket.c:1237-1238 does kfree(auth_str, M_TEMP) where auth_str == P+4. On the default GENERIC kernel (INVARIANTS ON), this corrupts the slab allocator's chunk tracking. The corruption is detected deferred by the periodic slab_cleanup() GC timer, which calls chunk_mark_free() and trips:

panic: assertion "(((intptr_t)chunk ^ (intptr_t)z) & ZoneMask) == 0"
       failed in chunk_mark_free at kern_slaballoc.c:1675

Live reproduction (deterministic kernel harness)

A KLD module (df0825_harness.c) constructs a minimal struct nfsmount with a planted nickname entry (uid 1001, nickname 0xDEADBEEF) and calls the real nfs_getnickauth() (kernel symbol 0xffffffff80809570). It then inspects where auth_str actually points.

Unpatched #0 kernel — 3 runs, all show the bug:

DF-0825: auth_str = 0xfffff8008d680c84  ← last nibble 4 = off-by-4 from base
DF-0825: auth_str[0..3] = 0xdeadbeef    ← nickname, NOT RPCAKN_NICKNAME
DF-0825: auth_str[4..7] = 0x00000000    ← OOB heap (4 bytes past alloc)
DF-0825: *** BUG CONFIRMED ***

The auth_str pointer consistently ends in nibble 4 across all 3 runs (0x...c84, 0x...6a4, 0x...914) — proving it is always base+4, never the base.

After the harness runs kfree(auth_str) (= kfree(P+4)), the deferred slab panic fires:

panic: assertion "(((intptr_t)chunk ^ (intptr_t)z) & ZoneMask) == 0"
       failed in chunk_mark_free at kern_slaballoc.c:1675
chunk_mark_free() → slab_cleanup() → slotimer_callback() → softclock_handler()

Patched #1 kernel (fix applied) — bug is GONE:

DF-0825: auth_str = 0xfffff8008d382270  ← last nibble 0 = allocation base
DF-0825: auth_str[0..3] = 0x00000001    ← RPCAKN_NICKNAME ✓
DF-0825: auth_str[4..7] = 0xdeadbeef    ← nickname ✓
DF-0825: OK — auth_str points at allocation base (bug fixed)

Guest stays alive after 15+ seconds; no deferred slab panic.

Reachability assessment

nfs_getnickauth is reached when an NFS client mount has NFSMNT_KERB set (mount -o kerb) AND a nickname entry exists for the calling uid. The nickname is established via nfs_savenickauth() (nfs_socket.c:1499-1501) after the server responds to an RPC with a RPCAUTH_KERB4 verifier.

Important: NFSKERB (the compile-time Kerberos v4 switch) is never defined in any shipped DragonFlyBSD kernel config (grep -rn "define NFSKERB" sys/ → empty). The code compiles with stub 2-byte key typedefs and no-op encryption. The #ifdef NFSKERB / XXX / #endif block at nfs_syscalls.c:1136 contains a literal XXX placeholder, confirming this path was never fully implemented for modern use.

However, the buggy code at lines 1115-1119 is NOT behind #ifdef NFSKERB — it is unconditionally compiled into every GENERIC kernel. And nfs_getnickauth IS called at runtime whenever an NFSMNT_KERB mount is active. The function is a live kernel symbol (nm confirms T nfs_getnickauth at 0xffffffff80809570).

An unprivileged user on a client with a -o kerb NFS mount, after the nickname exchange completes, triggers this bug on every subsequent NFS RPC.

Impact

• OOB heap read: 4 bytes of uninitialized/freed kernel heap memory leaked into the NFS RPC auth credential, potentially transmitted to a remote NFS server (info leak).
• Corrupted RPC auth: The credential data sent to the server is shifted by 4 bytes (wrong auth type/sequence → auth failures or misparse).
• Slab corruption → panic: kfree(P+4) corrupts the slab allocator; under INVARIANTS (default GENERIC) this is detected by the periodic slab GC and causes a kernel panic (local DoS).
• No uid=0 escalation path: This is an OOB read + data corruption primitive, not a write primitive. The 4 OOB bytes are read (leaked), not written through. There is no attacker-controlled write here → no escalation chain.

Fix

fix.diff replaces the post-increment writes with array-index writes that preserve the base pointer:

-   *nickp++ = txdr_unsigned(RPCAKN_NICKNAME);
-   *nickp = txdr_unsigned(nuidp->nu_nickname);
+   nickp[0] = txdr_unsigned(RPCAKN_NICKNAME);
+   nickp[1] = txdr_unsigned(nuidp->nu_nickname);
    *auth_str = (char *)nickp;   // now correctly = base

Validated on a single-fix kernel (#1): the off-by-4 is gone, auth_str is properly aligned, auth_str[0] = RPCAKN_NICKNAME, and no panic occurs.