⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1874

Signed int32 (daddr_t) overflow in block/offset math corrupts data.data pointer for >1 TiB SDXC cards

Summary

daddr_t is __int32_t sys/sys/types.h:80 max +2^31 sectors = ~1 TiB at 512B/sector. mmcsd_rw L329 daddr_t block end; L338 block=bio->bio_offset/sz bio_offset is off_t(64) sz int RHS int64 assigned to int32 -> silent truncation. L339 end=block+(b_bcount/sz) wraps too. L342 vaddr=bp->b_data+(block-(bio_offset/sz))*sz block(negative int32) promoted int64 subtracted from true large positive -> ~-2TiB byte offset vaddr=bp->b_data-~2TiB wild caddr_t. L364 data.data=vaddr handed to host controller DMA. mmcsd_delete L399-400 and mmcsd_task L533-534 identical truncation. Disk framework uses d_media_blocks uint64 disk.h:85 and 64-bit bio_offset so sends bios above 1TiB for any card that big. Trigger: >1TiB MicroSDXC or reprogrammed CSD faking >2^31 sectors. Auto-probe backup GPT at LBA(capacity-1) bio_offset>2^40 hits overflow. Impact: reliable local DoS every I/O above 1TiB fails; potential kernel panic if DMA engine faults on wild address. Default config sdhci. Fix: use uint64_t for block/end in all three functions.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1874 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 357 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1874 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/disk/mmcsd/mmcsd.c:338-534. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

mmcsd IS in GENERIC but no MMC HW in guest. Source: daddr_t is __int32_t; mmcsd_rw at L338 block=bio->bio_offset/sz (off_t/int), L339 end=block+(b_bcount/sz). For >=1 TiB at 512B/sector, the int32 silently truncates; subsequent vaddr = bp->b_data + (block - (bio->bio_offset/sz)) * sz uses truncated arithmetic for offsets.

Add if (sz <= 0) return 0; guard at the top of mmcsd_rw (defence-in-depth; the underlying int32 truncation is a separate concern).

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1874/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Add if (sz <= 0) return 0; guard at the top of mmcsd_rw (defence-in-depth). Full git-apply-able diff in findings/poc/DF-1874/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/disk/mmcsd/mmcsd.c:338-534. mmcsd IS in GENERIC but no MMC HW in guest. daddr_t is __int32_t; mmcsd_rw L338 block=bio->bio_offset/sz (off_t/int) silently truncates for >=1 TiB at 512B/sector; vaddr uses truncated arithmetic. HW gated.