DF-0874 — Unbounded attr_indexentry walk in ntfs_readdir

Medium · CWE-125 OOB Read · sys/vfs/ntfs/ntfs_vnops.c:585-586

ntfs_readdir walks attr_indexentry records using the attacker-controlled on-disk ie_reclen as stride, with no bound check against the INDEX block buffer (fp->f_dirblbuf). A crafted NTFS image walks the pointer into kernel heap → OOB read / info leak / DoS. The sibling walk in ntfs_ntreaddir (ntfs_subr.c:1176) is bounded; ntfs_readdir is not.

Reproduce

./build.sh                       # cc trigger.c + harness.c (guest, maxx)
# root mounts the crafted image (vfs.usermount=0); maxx readdir's it:
ssh dfbsd 'vnconfig -c vn0 /root/poc/DF-0874/ntfs_reclen0.img &&
           mount -t ntfs -o ro,-u=1001,-g=1001 /dev/vn0 /mnt/t'
ssh dfbsd-maxx 'cd poc/DF-0874 && ./trigger /mnt/t'    # 257 duplicate dirents (BUG)
ssh dfbsd-maxx 'cd poc/DF-0874 && ./harness 0xFFF0 0 1' # code-level OOB proof

Expected (bug present, unpatched #0): readdir returns 257 entries (.. + 256× HHHH) because reclen=0 makes the walk never advance. The harness shows the walk dereferences 64 KB past the 4 KB buffer.

Expected (fixed): readdir returns EINVAL (0 entries); the harness walk is bounded; a clean image still returns the correct dirents.

Files

Impact

Read-only primitive — no escalation. Ceiling: kernel heap info leak / DoS (dirent flood or page-fault panic if the OOB offset escapes mapped kmem). On default GENERIC (INVARIANTS ON) the slab poison typically masks observable exfiltration; on non-INVARIANTS the leak is directly observable.

DF-0874 — Unbounded attr_indexentry walk in ntfs_readdir inner loop

Verdict: REPRODUCED (OOB read / DoS) — fix VALIDATED on default GENERIC.

The bug

ntfs_readdir (sys/vfs/ntfs/ntfs_vnops.c:585-586) walks struct attr_indexentry records in the root directory's $INDEX_ROOT:$I30 buffer (fp->f_dirblbuf) using the attacker-controlled on-disk ie_reclen as the stride, with no check that the walking pointer stays inside the buffer:

for (; !(iep->ie_flag & NTFS_IEFLAG_LAST);
    iep = NTFS_NEXTREC(iep, struct attr_indexentry *))
{   ... vop_write_dirent(iep->ie_number, ..., convname(iep->ie_fname)) ...   }

where NTFS_NEXTREC(s, type) = (type)(((caddr_t)s) + (s)->reclen) (ntfs.h:273) and reclen is a u_int16_t read straight off the disk image.

The sibling walk in ntfs_ntreaddir (sys/vfs/ntfs/ntfs_subr.c:1176-1178) is bounded — for (; !(iep->ie_flag & LAST) && (rdsize > aoff); aoff += iep->reclen, ...) — and uses that bounded walk to find the num-th permitted entry, returning a pointer into f_dirblbuf. ntfs_readdir then restarts an unbounded walk from that returned pointer. That is the hole: the returned entry's reclen is never validated against the buffer, so a crafted image drives the pointer into kernel heap.

Trigger & impact

Precondition (realistic, per AGENT.md threat model): an admin has mounted (or made mountable) a crafted NTFS image. mount_ntfs auto-loads ntfs.ko; the unprivileged user then readdirs the mount point. ntfs is optional ntfs (sys/conf/files) and ships as /boot/kernel/ntfs.ko — not compiled into GENERIC.

Three crafted variants, all confirmed on the default GENERIC kernel (6.5-DEVELOPMENT #0, INVARIANTS ON):

This is a read-only primitive (CWE-125 OOB read) — no write, so there is no privilege-escalation chain. The realistic impact ceiling is kernel heap info leak / DoS, matching the Medium severity.

Reproduction (decisive evidence)

Live GENERIC (#0 unpatched), reclen=0 image — the walk emits 257 duplicate dirents (.. + 256× HHHH, d_ino=0x48484848), proving the stride is unvalidated and never bounds-checked (full 259-line log in run_reclen0.out):

dirent[0]: d_ino=0x5 d_name='..'
dirent[1]: d_ino=0x48484848 d_name='HHHH'
dirent[2]: d_ino=0x48484848 d_name='HHHH'
  ... (256 duplicates) ...
dirent[256]: d_ino=0x48484848 d_name='HHHH'
[+] readdir returned 257 entries

Deterministic code-level harness (harness.c) — replicates the exact vnops.c:585 (unbounded) and subr.c:1176 (bounded) walks against the same crafted INDEX_ROOT data with a guard page, proving the vnops walk reads past the buffer while the subr walk does not:

$ ./harness 0xFFF0 0 1   # reclen=0xFFF0, no LAST, INVARIANTS poison
  [subr.c:1176 BOUNDED walk]  walked to off=32 (rdsize=122): IN-BOUNDS (safe)
  [vnops.c:585 UNBOUNDED walk] steps=2 max_off=65552 oob_derefs=1
    => BUG CONFIRMED: ntfs_readdir dereferenced index entries 1 time(s) PAST
       the INDEX_ROOT valid data (rdsize=122) using attacker reclen=0xfff0.

The fix (fix.diff)

Bounds the ntfs_readdir inner walk against fp->f_dirblbuf / fp->f_dirblsz (mirroring the bounded walk already in ntfs_ntreaddir), and rejects a reclen smaller than the fixed entry header (prevents the reclen==0 stall/DoS):

for (; (caddr_t)iep >= fp->f_dirblbuf &&
     (caddr_t)iep + __offsetof(struct attr_indexentry, ie_fname) <=
     fp->f_dirblbuf + fp->f_dirblsz;
     iep = NTFS_NEXTREC(iep, struct attr_indexentry *))
{
    if (iep->ie_flag & NTFS_IEFLAG_LAST)
        break;
    if (iep->reclen < __offsetof(struct attr_indexentry, ie_fname)) {
        error = EINVAL;
        goto done;
    }
    ... existing body unchanged ...

Fix validation (Phase 8)

Built the patched ntfs.ko standalone (cd sys/vfs/ntfs && make, rc=0, 846888df…), hot-swapped /boot/kernel/ntfs.ko, kldload'd it (kernel #0 unchanged — ntfs is a module). Re-ran the SAME triggers:

Full before/after contrast in fix_run.log; full module build log in fix_build.log.

Notes

• The DragonFly NTFS driver has a pre-existing lockmgr panic (lockmgr: locking against myself in ntfs_mountfs→vflush→vx_get, the DF-0786 sibling) that fires on some crafted images during mount cleanup. It is unrelated to this bug. A hybrid base (DF-0873's known-mountable image with the DF-0874 evil $INDEX_ROOT swapped in) mounts cleanly and reaches ntfs_readdir, so the live path is exercised without the sibling panic.
• reclen=0 gives the cleanest live-GENERIC demonstration because it makes the unbounded walk visible (dirent flood) without depending on heap-residue content. The reclen=0xFFF0 / 0x60 OOB-read variants fire on GENERIC but the INVARIANTS slab poison (0xdeadc0de, bit-2 = LAST) typically masks observable exfiltration; the harness proves the OOB deref occurs regardless.
• No escalation chain: this is a pure OOB read (no write primitive), so the impact ceiling is info-leak / DoS, consistent with the Medium rating.