DF-1120 — Buddy allocator unbounded merge OOB write in ___sym_mfree (SCSI sym)

Finding

___sym_mfree at sys/dev/disk/sym/sym_hipd.c:476-497 has a merge loop whose index i climbs without bound. The h[] array is declared at :408 as h[MEMO_CLUSTER_SHIFT - MEMO_SHIFT + 1] = h[9] on x86_64 (indices 0–8). The MEMO_FREE_UNUSED guard at :477 is wrapped in #if 0 ... #endif at :366-368, so it does NOT compile in. When two buddy-adjacent 4096-byte (MEMO_CLUSTER_SIZE) allocations are freed, the merge succeeds at i=8 (s becomes 8192), and the next loop top does q = &h[9] → 8-byte OOB write past m_pool_s.h[] into adjacent kernel heap.

Reachability on this guest

NOT reachable. No SCSI sym HBA is present (pciconf -lv shows only virtio devices + PIIX3). sym.ko is loadable but never attaches. The bug is a latent heap-corruption primitive.

A userspace harness replicates the allocator bookkeeping with the same layout and demonstrates the OOB write into a canary.

Build / Run / Expected

cc -O2 -o harness harness.c     # build.sh
./harness                        # run.sh
# Expected: "*** OOB WRITE at h[9] -- canary corrupted ***"

Files

• harness.c — allocator bookkeeping replica demonstrating the OOB at h[9].
• fix.diff — adds if (s >= MEMO_CLUSTER_SIZE) break; unconditional guard at the top of the merge loop.
• build.log / run.log / env.txt — captured outputs.

VERDICT — DF-1120

Verdict: REPRODUCED (primitive) / NOT REACHABLE on guest (HW-gated)

The cited bug is real and confirmed by source trace + userspace allocator replica. It is a latent heap-corruption primitive: reachable only when a SCSI sym HBA is attached and two buddy-adjacent 4096-byte allocations are freed in succession, which this audit guest has no HW to trigger.

Mechanism (confirmed path:line)

1. ___sym_mfree (sys/dev/disk/sym/sym_hipd.c:454-497) frees a block. The block size walks up via while (size > s) { s <<= 1; ++i; } to find its buddy bucket. For a 4096-byte block: i reaches 8, s = 4096 = MEMO_CLUSTER_SIZE.
2. The merge loop at :476-497 is while (1) with no upper bound on i. The MEMO_FREE_UNUSED early-exit (:477-481) is wrapped in #if 0 ... #endif at :366-368, so it does not compile in.
3. When a buddy is found at level i, the loop unlinks it, sets a = a & b; s <<= 1; ++i; and continues. For two buddy-adjacent 4096-byte blocks: merge at i=8 succeeds (s becomes 8192, i=9).
4. Next loop top: q = &h[i] = &h[9]. But h[] is declared at :408 as h[MEMO_CLUSTER_SHIFT - MEMO_SHIFT + 1] = h[9] (indices 0–8 valid). h[9] is an 8-byte OOB write past m_pool_s.h[] into whatever follows in kernel heap.

Reproduction (userspace harness)

The harness allocates two page-aligned buddy-adjacent 4096-byte regions, replicates the exact merge-loop bookkeeping with h[9] + canary layout, and demonstrates the OOB write:

*** OOB WRITE at h[9] -- canary corrupted ***
    canary before = 0xdeadbeefcafebabe
    canary after  = 0x00000008004ae000  (OVERWRITTEN)

Impact ceiling

• Per-trigger: 8-byte heap write at a fixed offset past m_pool_s. Content is a kernel heap address (the merged buddy pointer) — partially attacker-influenced via prior allocation patterns.
• Slab-bucket: m_pool_s is kmalloc'd from M_DEVBUF. The 8 bytes after h[8] land in the adjacent heap object — type depends on what was allocated next. On the default GENERIC kernel (INVARIANTS ON), the WEIRD_ADDR (0xdeadc0de) poisoning and slab magic checks would likely catch cross-type corruption and panic before exploitation lands; this is a DoS on GENERIC, not a clean uid=0.
• Privilege: requires the ability to cause sym driver attach/detach cycles (hot-pluggable PCI SCSI HBA or kldunload sym). The unprivileged path is narrow (requires operator on the device node).
• Realistic: SCSI sym (SYM53C8XX) is legacy hardware.

Fix

fix.diff adds an unconditional upper-bound guard at the top of the merge loop:

if (s >= MEMO_CLUSTER_SIZE)
    break;

This fires before any h[i] access when i would exceed the array, regardless of whether MEMO_FREE_UNUSED is compiled in. Minimal, targeted, one logical change.

Validated: sym.ko builds with RC=0 after applying the fix.

Fix validation

• Patch applies cleanly: Hunk #1 succeeded at 474.
• make in sys/dev/disk/sym/ → sym.ko linked, RC=0.
• Cannot boot-test (no SCSI sym HBA); fix_status: not_testable.

PoC changes

• harness.c written from scratch. Uses posix_memalign for real page-aligned buddy addresses so the linked-list manipulation is valid; places a canary after h[8] to demonstrate the OOB write.