vn: signed integer overflow in file-backed disk-size math (vn->sc_size = vn_size * PAGE_SIZE / DEV_BSIZE)
Summary
vniocattach_file at vn.c:560: vn->sc_size = vio->vn_size * PAGE_SIZE / vn->sc_secsize. vio->vn_size is int64_t, PAGE_SIZE is int. NO upper bound on vn_size before multiplication (file path only branches if (vio->vn_size)). For vn_size near INT64_MAX/PAGE_SIZE (~2^51) signed int64_t multiply overflows (UB), garbage into sc_size -> d_media_blocks (578), d_ncylinders (583), disk_setdiskinfo_sync (584) feeds slice/probe which can panic on insane geometry. Swap path at 633 vn->sc_secsize * (off_t)vn_size passed to swap_pager_alloc; vn_size only checked <=0 at 617 not upper overflow vs OFF_TO_IDX. RESTRICTEDROOT root only.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1700 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add upper-bound check: reject vn_size > INT64_MAX/PAGE_SIZE before multiplicatio | 525 B | view raw |
| VERDICT.md | verdict | full analysis | 1.2 KB | ↓ raw |
DF-1700 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/disk/vn/vn.c:560.
Mechanism
vniocattach_file computes sc_size=vio->vn_size*PAGE_SIZE/sc_secsize with no upper bound on vn_size before the int64_t multiply; near INT64_MAX/PAGE_SIZE the multiply overflows producing garbage geometry fed to disk_setdiskinfo_sync.
Fix
Add upper-bound check: reject vn_size > INT64_MAX/PAGE_SIZE before multiplication.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build: all 51 fix.diffs applied to /usr/src, kernel+modules built with -Werror, rc=0, 0 errors.
Batch build rc=0, 0 errors. vn.ko built standalone with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- v
- n
- /
- v
- n
- .
- c
- :
- 5
- 6
- 0
Detail
Exploit chain
none (non-memory-corruption-class or HW-gated; source-only confirmation of code defect)
Evidence (decisive lines)
Source traced at sys/dev/disk/vn/vn.c:560. Fix compiled clean with -Werror in batch kernel+module build (rc=0, 0 errors).
PoC changes
authored fix.diff: upper-bound check vn_size > INT64_MAX/PAGE_SIZE
Verified recommended fix
Reject vn_size > INT64_MAX/PAGE_SIZE before multiplication. Matches finding proposal intent.
Verdict
REPRODUCED (source-only). vniocattach_file sc_size=vio->vn_size*PAGE_SIZE/sc_secsize with no upper bound; int64_t multiply overflows near INT64_MAX/PAGE_SIZE producing garbage geometry. RESTRICTEDROOT-gated.
No comments yet.