DF-2224 — seq_printf() forwards __va_list into ksnprintf instead of kvsnprintf

Status: REPRODUCED (verbatim-code, kernel-compiled rig) — demonstrated primitive: every conversion garbled + %p prints a kernel stack address (KASLR-defeating leak flavor) into the seq buffer. LATENT in the stock tree (CONFIG_DEBUG_FS undefined → i915 show callbacks compiled out; drm_dp_downstream_debug has zero in-tree callers). Fix: A/B-validated in the same harness kernel (fix.diff, one token: ksnprintf → kvsnprintf).

Part of the DF-22X batch (DF-2216 / DF-2220 / DF-2223 / DF-2224) verified in ONE harness kernel; this pack documents the DF-2224 section.

What this pack contains

Same layout as the DF-2216 pack; finding-specific: fix.diff (against sys/dev/drm/linux_printf.c), run_section.log (DF-2224 lines).

How to reproduce

Identical to the DF-2216 pack (same batch build + run).

Provenance

1. guest tree linux_printf.c sha256 a0570e25... == audited tree; seq_printf compiled into the kernel verbatim.
2. seq_printf_fixed = same bytes + fix.diff, def renamed (fixed_printf.c sha256 553ca5b7...).
3. Each case calls baseline and fixed back-to-back with identical variadic arguments into separate 64-byte buffers bracketed by 32-byte 0xCC canary zones — exactly how production callers invoke the function (direct variadic calls; a va_list trampoline would have changed the register setup).

Expected output (baseline = unmodified production code)

DF2224 BASELINE [int fmt ...] buf=[402699856/48879/5f5e100] canaries=INTACT ...
DF2224 FIXED    [int fmt ...] buf=[111/222222/beef] canaries=INTACT ...
DF2224 BASELINE [%p of 0xdeadbeef ...] buf=[ptr=0xfffff8011800b650] canaries=INTACT ...
DF2224 FIXED    [%p of 0xdeadbeef] buf=[ptr=0xdeadbeef] canaries=INTACT ...
DF2224 witness: rig kernel stack address for comparison: 0xfffff8011800b6ec ...
DF2224 BASELINE [%s of hi] buf=[s=[^P]] canaries=INTACT ...
DF2224 FIXED    [%s of hi] buf=[s=[hi]] canaries=INTACT ...

What the baseline output proves (x86-64 SysV ABI)

__va_list is an array of one struct that decays to a pointer; passing it as ksnprintf's 4th C argument puts the pointer itself into ksnprintf's first variadic slot (rcx):

• %d (first conversion) prints the low 32 bits of &ap — a kernel stack address (402699856 = 0x17FFB7F0-ish; run-dependent with the stack address).
• Subsequent conversions read stale registers: 48879 (0xbeef) is the caller's third argument arriving in the second slot via leftover r8; 5f5e100 is stale r9 junk. The intended 111/222222 never print.
• %p prints the actual &ap kernel stack address — 0xfffff8011800b650, just 0x9c bytes from the rig's witness frame (0xfffff8011800b6ec). Across 3 runs the printed value is always a canonical kernel stack address in the same thread stack (0xfffff801166db650 / 0xfffff8011800b650 / 0xfffff80118005650) — the leak-flavor primitive, stable in shape.
• %s consumes &ap as a char *; the va_list struct begins with gp_offset = 16 (two named GP args before the varargs), so it prints the single byte 0x10 (^P) — a deterministic ABI artifact, not hi.
• Canary zones INTACT in every case: both ksnprintf and kvsnprintf bound-respect; the bug is a forwarding/garbage bug, not an overflow.

Attacker input / reachability (honest: LATENT)

seq_printf callers compiled in the stock tree: the i915 debugfs show callbacks (i915_gem_gtt.c:1540+, gen8/gen6 dump) are all inside #if defined(CONFIG_DEBUG_FS) and kconfig.h does not define it; drm_dp_downstream_debug (drm_dp_helper.c:586-662, EXPORT_SYMBOL) has zero in-tree callers. So today there is no runtime trigger on a stock system — the defect, its garbage output, and its kernel-stack-address disclosure are proven through the verbatim function; any future port enabling debugfs-style callers would light it up. No write primitive → no privesc route; severity stays Low.

DF-2224 — VERDICT

REPRODUCED — verbatim-code, kernel-compiled rig; the misforwarding is proven byte-for-byte, including the kernel-stack-address leak flavor of %p; fix A/B-validated in the same kernel (one token). LATENT in the stock tree: no compiled-in caller exists today. Impact: if ever called, garbled output plus a kernel stack address disclosure (KASLR-defeating); currently zero stock-system reachability. No write primitive, no privesc route (see below).

Rig class and why

Same batch harness kernel as DF-2216 (DFV22X); the production sys/dev/drm/linux_printf.c is #included verbatim (sha-gated a0570e25...). Baseline and fixed are called back-to-back with identical variadic arguments into separate canary-bracketed buffers.

Line-accurate confirmation

linux_printf.c:37: ksnprintf(m->buf, m->size, f, ap); — ksnprintf is __printflike(3,4) variadic; passing an __va_list into a ... parameter does NOT forward the original arguments. The correct API (used by the verbatim kvasprintf two files over) is kvsnprintf(char *, size_t, const char *, __va_list). The fix is exactly one token.

Mechanical reproduction (decisive run, run.log) — with ABI derivation

On x86-64 SysV, seq_printf(m, f, args...) receives args in rdi/rsi/rdx/rcx/r8/r9; its ap points into its register-save-area. The call ksnprintf(buf, size, f, ap) puts the ap pointer value in rcx — ksnprintf's first variadic slot. Every conversion therefore reads the pointer / stale registers, never the caller's arguments:

• First %d = low 32 bits of &ap (kernel stack address; run-dependent).
• %p prints the full &ap — a kernel stack address, observed 0xfffff8011800b650 vs the rig witness frame 0xfffff8011800b6ec (0x9c bytes apart, same thread stack). Stable in shape across 3 runs: 0xfffff801166db650, 0xfffff8011800b650, 0xfffff80118005650 — always a canonical kernel-stack address in seq_printf's own frame region. That is the KASLR-defeating disclosure primitive the finding predicted for %p.
• %s prints exactly one byte, 0x10 = the va_list struct's gp_offset (16, because m and f occupy rdi/rsi) — a fully deterministic ABI artifact proving the formatter is walking the va_list struct bytes, not the arguments.
• The second/third conversions show the stale-register shuffle: 48879 (0xbeef, the caller's third argument, leftover in r8) arrives in the second slot while the intended second argument 222222 is lost — nothing the caller passed arrives where it should.
• Canary zones (32 B of 0xCC on both sides of the 64 B seq buffer) are INTACT in every case: both formatters bound-respect — this is a forwarding bug, not an overflow.

Fix validation (A/B, same kernel)

fix.diff (one token, ksnprintf → kvsnprintf) extracted-from-patched-bytes as seq_printf_fixed in the same kernel: all three cases produce the exact intended strings, canaries intact, identical call pattern. fix_status: fixed. (Note the adjacent functional bug — seq_printf always writes from buf[0] and discards the length return, i.e. no append/cursor semantics — is unchanged by this fix; it is a functional divergence, not memory-unsafe, and is noted for upstream.)

Reachability (honest: LATENT)

Compiled-in callers in the stock tree: the i915 debugfs show callbacks (i915_gem_gtt.c:1540+, :1592+, gen8/gen6 dump paths) all sit inside #if defined(CONFIG_DEBUG_FS); sys/dev/drm/kconfig.h does not define it. drm_dp_downstream_debug (drm_dp_helper.c:586-662) is compiled and EXPORT_SYMBOLed but has zero in-tree callers. Therefore no stock runtime trigger exists today; the demonstrated primitive requires a future/ported caller (any debugfs-enable or new consumer of the shim). Defect, garbage output, and stack-address disclosure are all proven through the verbatim function. Filed Low severity stands.

Privesc assessment (standing directive)

None. The bug mis-reads varargs (garbage in, bounded write out). The write is always confined to m->buf[0..m->size) by ksnprintf's bounds; the only security-relevant consequence is the demonstrated kernel-stack-address disclosure (and output corruption). Even with the leak, this guest and stock systems have no caller to invoke it, and a stack-address leak alone is not an escalation primitive.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.