DF-0887 — Heap overflow in ffs_truncate symlink fast-path (unbounded bzero)

Bug

sys/vfs/ufs/ffs_inode.c:159-168 — ffs_truncate fast path is entered for VLNK inodes when i_size < mnt_maxsymlinklen OR i_din.di_blocks == 0. The di_blocks == 0 arm enters regardless of i_size. The fast path then does:

bzero((char *)&oip->i_shortlink, (uint)oip->i_size);

i_shortlink aliases i_din.di_shortlink aliases i_din.di_db (inode.h:126, dinode.h:111-112), which is ufs_daddr_t[12] = 48 bytes (dinode.h:83). i_size is the on-disk di_size copied verbatim into the in-memory inode at ffs_vfsops.c:1147. A crafted UFS1 inode with di_mode=S_IFLNK, di_blocks=0, di_size=4096, di_nlink<=0 therefore causes a 4048-byte zero-write past the 48-byte di_db buffer into the M_FFSNODE slab heap and beyond. (Even UFS1_MAXSYMLINKLEN=60 > 48B makes the size arm inherently overflow by up to 12 bytes.)

Trigger path: mount crafted image, stat the symlink -> ufs_iget reads the forged dinode -> ufs_vinit sets vp->v_type=VLNK (ufs_vnops.c:1962) -> on vnode release, ufs_inactive (ufs_inode.c:62) sees i_nlink<=0 and calls ffs_truncate(vp, 0) (ufs_inode.c:83) -> fast path -> unbounded bzero.

Build / run / expected

# in guest as root
sh ./build.sh
sh ./run.sh        # expect: harness shows 4048B OOB; live mount+stat panics

Expected on the unpatched #0 GENERIC kernel (INVARIANTS ON): - harness 4096 0 prints OOB WRITE of 4048 bytes past the 48-byte i_shortlink buffer. - Live trigger: kernel panic — either a slab-corruption INVARIANTS trap, or a page fault when the bzero runs past the slab page into an unmapped page. The panic signature is captured in panic.txt (from dfbsd-qemu/boot.log).

Expected on the patched #1 single-fix kernel: harness output unchanged (it transcribes the unpatched code), but the live stat returns cleanly, no panic, guest stays up.

Files

Impact ceiling

UFS is not user-mountable on DragonFly (get_fscap -> SYSCAP_RESTRICTEDROOT for UFS; same blocker documented in DF-0820). So this is a root-context mount of attacker-supplied media -> kernel heap corruption / panic (a hardening gap / DoS), not an LPE. On default GENERIC (INVARIANTS ON) the unbounded write lands in the M_FFSNODE slab and is caught as slab corruption or runs into an unmapped page -> panic before any grooming can land. On INVARIANTS-OFF builds the unbounded zero-write still page-faults synchronously inside the mount/stat syscall before the caller can observe or convert the corruption.

DF-0887 — Heap overflow in ffs_truncate symlink fast-path (unbounded bzero)

Verdict: REPRODUCED (heap overflow / panic; root-reachable) — NOT exploitable to uid=0 (valid hard blocker); FIX VALIDATED

The bug claimed in the finding is real and confirmed line-by-line. The ffs_truncate symlink fast path enters unconditionally for any VLNK inode whose on-disk di_blocks == 0, regardless of i_size, and then runs:

bzero((char *)&oip->i_shortlink, (uint)oip->i_size);

i_shortlink aliases di_db (ufs_daddr_t[UFS_NDADDR=12] = 48 bytes) — and i_size is the on-disk di_size copied verbatim into the in-memory inode at ffs_vfsops.c:1147. A crafted VLNK inode with di_blocks=0 and a large di_size therefore drives an OOB write of (di_size - 48) bytes past the shortlink buffer into the M_FFSNODE slab heap and beyond. Two distinct live manifestations were captured on the default X86_64_GENERIC (#0, INVARIANTS ON) kernel; the primitive was independently characterized with a deterministic userspace harness (harness 4096 0 ⇒ OOB WRITE of 4048 bytes). A targeted single-line fix.diff was authored, built as a single-fix #1 kernel, and validated: the exact trigger that deterministically panics #0 runs cleanly on #1 (no panic, guest stays up) with no regression on legitimate filesystems.

The finding's impact ceiling ("root-context mount of attacker media → heap corruption / panic") is confirmed; the implicit LPE angle is not reachable because UFS is not user-mountable on DragonFly (same hard blocker documented in DF-0820). This is a real, fixable code defect — but a hardening gap / DoS, not an LPE.

1. Source trace (every cited line confirmed against /usr/src and host sys/)

ffs_truncate (sys/vfs/ufs/ffs_inode.c), with line numbers verified byte-identical between host sys/ and guest /usr/src:

137: int ffs_truncate(struct vnode *vp, off_t length, int flags, struct ucred *cred)
153:     oip = VTOI(ovp);
159:     if (ovp->v_type == VLNK &&
160:         (oip->i_size < ovp->v_mount->mnt_maxsymlinklen || oip->i_din.di_blocks == 0)) {
161: #ifdef DIAGNOSTIC
162:         if (length != 0) panic(...);       // length==0 from ufs_inactive
164: #endif
165:         bzero((char *)&oip->i_shortlink, (uint)oip->i_size);   // <-- UNBOUNDED
166:         oip->i_size = 0;
168:         return (ffs_update(ovp, 1));
169:     }

Layout facts (all confirmed in sys/vfs/ufs/): - inode.h:105 — struct ufs1_dinode i_din; is the LAST field of struct inode (allocated via kmalloc(sizeof(inode), M_FFSNODE)). - inode.h:126 — #define i_shortlink i_din.di_shortlink. - dinode.h:111-112 — #define di_shortlink di_db → aliases the start of di_db. - dinode.h:83 — ufs_daddr_t di_db[UFS_NDADDR]; with UFS_NDADDR=12 (dinode.h:66) ⇒ 48-byte buffer. - dinode.h:114 — UFS1_MAXSYMLINKLEN = (UFS_NDADDR + UFS_NIADDR) * sizeof(ufs_daddr_t) = (12+3)*4 = 60 — already 12 bytes larger than the 48-byte di_db it overflows. Even the legitimate i_size < mnt_maxsymlinklen arm can overflow by up to 12 bytes. - ffs_vfsops.c:1147 — ip->i_din = *((struct ufs1_dinode *)bp->b_data + ino_to_fsbo(fs, ino)); — di_size, di_blocks, di_nlink, di_mode are copied verbatim from disk into the in-memory inode. No bounds check.

Trigger path (confirmed end-to-end): - ufs_inode.c:62 ufs_inactive() — runs when the vnode refcount drops to 0. - ufs_inode.c:77 — if (ip->i_nlink <= 0 && (vp->v_mount->mnt_flag & MNT_RDONLY) == 0) - ufs_inode.c:83 — error = ffs_truncate(vp, (off_t)0, 0, NOCRED); - ufs_vnops.c:1962 — vp->v_type = IFTOVT(ip->i_mode); — for S_IFLNK ⇒ VLNK.

So: mount crafted image → stat /mnt/test/evil ⇒ iget reads forged dinode ⇒ ufs_vinit sets vp->v_type=VLNK ⇒ stat returns ⇒ vnode refcount→0 ⇒ ufs_inactive sees nlink=0 ⇒ ffs_truncate(vp,0) ⇒ fast path entered (VLNK && di_blocks==0) ⇒ bzero(&i_shortlink, 131072) ⇒ 128 KB OOB zero-write into the slab heap.

2. Reproduced manifestations (live, on default #0 GENERIC, INVARIANTS ON)

Image-craft recipe (reproduce.sh): 1. truncate -s 4M base.img && vnconfig -c vn0 base.img && newfs -v /dev/vn0 && vnconfig -u 2. mount, ln -s target_string /mnt/test/evil, record inode (3), unmount 3. craft_img binary-patches inode 3: di_size=<big>, di_nlink=0, di_blocks=0, di_mode=0xa1ff 4. mount -t ufs evil.img /mnt/test && stat /mnt/test/evil ⇒ triggers iget → ufs_inactive → ffs_truncate fast path

Manifestation A — di_size=4096 (the finding's value; probabilistic INVARIANTS slab-magic trap)

• Path: bzero(&i_shortlink, 4096) writes 4048 bytes past the 48-byte buffer.
• Live: panic: assertion "z->z_Magic == ZALLOC_SLAB_MAGIC" failed in _kfree at /usr/src/sys/kern/kern_slaballoc.c:1478 — backtrace _kfree ← _kfree ← soclose ← soo_close ← fdrop ← closef. The trap fires on the next _kfree after the corrupting bzero (in this capture: socket free during shell exit), proving the bzero wrote across adjacent slab zones. (panic.4096.txt)

Manifestation B — di_size=131072 (deterministic page-fault past slab pages)

• Path: bzero(&i_shortlink, 131072) runs past slab pages into unmapped kernel address space.
• Live: Fatal trap 12: page fault while in kernel mode / fault virtual address = 0x0 / Stopped at slab_cleanup+0x1c9: cmpq %rbx,(%rcx) — the zeroed slab metadata (NULL pointer) dereferences inside the slab allocator's cleanup path. (panic.txt, panic.131072.txt)

Deterministic harness (no kernel effect)

./harness 4096 0 transcribes the L159-168 fast path verbatim with a poisoned allocator and prints:

OOB write length        = 4048 bytes (di_size - 48)
OOB past end of struct inode = 4008 bytes (overflow past inode end)
RESULT: OOB WRITE of 4048 bytes past the 48-byte i_shortlink buffer.
        Heap corruption into M_FFSNODE slab (and beyond) confirmed.

This proves the primitive independent of the kernel slab layout lottery.

3. Phase 6 — escalation analysis: BLOCKED (valid hard blocker)

The primitive is a write-class bug (unbounded heap bzero of zeros, 4048+ bytes past a 48-byte buffer). On this guest (no SMAP/SMEP/KASLR), a bounded kernel write into a victim object is normally convertible to uid=0. Here the escalation is blocked by a valid Phase-6 hard blocker:

Blocker — UFS is NOT user-mountable; the trigger requires an already-root context

get_fscap() (sys/kern/vfs_syscalls.c) maps only null/devfs/procfs/ tmpfs/fusefs to user-mountable capabilities; UFS falls through to SYSCAP_RESTRICTEDROOT. In sys_mount, even with vfs.usermount=1, the capability check still fails for a non-root credential without the RESTRICTEDROOT cap (returns EPERM). This was already verified empirically on this guest in DF-0820 (VERDICT.md §3): with vfs.usermount=1, vnconfig'd and chowned /dev/vn0 to maxx, mount -t ufs as maxx → mount_ufs: /dev/vn0: Operation not permitted. (vnconfig itself also requires privilege.)

So the crafted inode can only be fed to ffs_truncate by an already-root caller. Root → kernel is not a privilege-boundary crossing (root can already kldload an arbitrary module). No unprivileged→root chain exists here. The realistic severity is Medium (root-context mount of attacker media → kernel panic/corruption / DoS) — same conclusion as DF-0820.

Additionally (same as DF-0820), even on a root-reachable mount the write is an unbounded synchronous zero-fill that page-faults before the mount/stat syscall returns (Manifestation B). The attacking process is blocked in the kernel for the entire window and is killed by the panic before it can observe or convert the corruption. There is no field combination that yields a small, precisely-bounded overwrite into a chosen victim — every oversized di_size produces either an INVARIANTS slab-corruption trap (Manifestation A) or an unbounded page-fault (Manifestation B). Hence no grooming → victim-corrupt → convert chain exists. (Same behavior on noinv: the page-fault is from the MMU, not INVARIANTS, so the second factor applies on both GENERIC and noinv.)

Demonstrated impact ceiling: panic / kernel heap corruption (root-reachable DoS / hardening gap). Not an LPE.

4. The fix (fix.diff)

A single targeted change to sys/vfs/ufs/ffs_inode.c, one hunk: - Replace bzero((char *)&oip->i_shortlink, (uint)oip->i_size); (line 165) with bzero((char *)&oip->i_shortlink, umin((uint)oip->i_size, sizeof(oip->i_shortlink))); — bound by the actual 48-byte buffer size. A multi-line comment explains the bug-class rationale.

This matches the finding markdown's ## Recommended fix proposal ("bound the bzero to min(i_size, sizeof(i_shortlink))"). The finding's proposal is exactly right; no supersedence is claimed.

The bound alone kills the security bug (the OOB write). The fast-path entry condition (di_blocks == 0 || i_size < mnt_maxsymlinklen) is left unchanged because: - For a legitimate di_blocks==0 inode the bzero is now an in-bounds clear of stale inline data (no overflow, no semantic change). - Adding a stricter entry check would change truncate behavior on di_blocks==0 && i_size > 48 inodes (a block-accounting change) that is outside the scope of this security fix.

5. Phase 8 — fix validation (single-fix #1 kernel)

• Baseline (#0, unpatched): both manifestations panic — assertion z_Magic==ZALLOC_SLAB_MAGIC (A) and Fatal trap 12 ... slab_cleanup+0x1c9 (B). (panic.4096.txt, panic.txt)
• Applied fix.diff with patch -p1 (hunk succeeded at line 162), built make -j6 nativekernel KERNCONF=X86_64_GENERIC (rc=0, ~7 min, fix_build.log), installed with make installkernel, rebooted ⇒ kern.version = 6.5-DEVELOPMENT #1: Sun Jul 5 17:59:08 UTC 2026, sha256=/boot/kernel/kernel=51efdf559ddd8b85fe25a82022dd72c4725f249a85654b058190557ff28cfed3.
• Patched #1, same crafted image (di_size=131072, the deterministic trigger): mount succeeds, stat /mnt/test/evil returns cleanly (STAT_RC=0), END_RC=0, guest stays up, no panic (fix_run.log). Repeated 3× to rule out non-determinism — all clean.
• Regression: a freshly newfs'd legitimate image still mounts read-write and accepts file creation on #1 — the fix does not break normal operation.

Before/after: | variant | baseline (#0) | patched (#1) | |---|---|---| | di_size=4096 | INVARIANTS slab-magic trap (_kfree) | clean STAT_RC=0, no panic | | di_size=131072 | page-fault slab_cleanup+0x1c9 | clean STAT_RC=0, no panic | | normal newfs img | mounts | mounts (regression OK) |

fix_status: fixed — clean before/after on both crash manifestations with no regression.

6. Caveats / next steps

• The finding's severity claim ("High") is partly right on the bug-reality side (the heap overflow is real and unbounded; CWE-787 is accurate) but the realistic exploit ceiling is Medium — root-context mount of attacker media → kernel panic/corruption / DoS, not an unprivileged LPE. A genuinely unprivileged variant would require an auto-mount/automount daemon mounting attacker-supplied media as root (not configured on this guest).
• The bug is structurally identical to DF-0820 in its root-only reachability; the fix validates cleanly against both manifestations.
• The harness transcribes the unpatched code path, so its output is intentionally unchanged before/after — it documents the primitive, not the runtime behavior. The runtime behavior change is what fix_run.log captures.