DF-2744 — disk_dumpcheck() unsigned underflow (reserved > media_blocks)

Impact

sys/kern/subr_disk.c:909 computes *size = pinfo.media_blocks - pinfo.reserved_blocks (u64 - u64). reserved_blocks derives from sp->ds_reserved, set for disklabel64 slices from the on-disk d_bbase/secsize (sys/kern/subr_disklabel64.c:521-527) with d_bbase validated only for magic/CRC in l64_readdisklabel (subr_disklabel64.c:174-196) — a crafted label yields reserved_blocks >> media_blocks. The subtraction wraps to ~2^64, so diskdump()'s bounds check (subr_disk.c:1291-1292, ap->a_offset + ap->a_length - offset > size) can never trigger: a crash dump configured on such a slice writes past the end of the dump partition (raw-device OOB writes at panic time). Secondary units bug in the same function: di.mediaoffset/mediasize are scaled by DEV_BSIZE (512) although blkno/size are in media blocks (subr_disk.c:935-936) — wrong dump geometry on non-512B-sector media.

Trigger requires root (write the crafted label; configure dumpdev) — Low.

Reproduce (guest, root)

python3 mkimages.py .                     # host: makes lbl64.img
vnconfig -c /dev/vn1 /root/lbl64.img      # MBR + DFLYBSD slice w/ label64
cc -O -o poc2744 poc2744.c && ./poc2744 /dev/vn1s1

Observed

media_blocks = 1024 reserved_blocks = 67108864 UNDERFLOW TRIGGER: *size = 1024 - 67108864 = 18446744073642443776 (the exact value disk_dumpcheck() returns and diskdump() compares against)

DF-2744 VERDICT — disk_dumpcheck() unsigned underflow

Status: reproduced (the underflow precondition and the exact wrapped value that feeds the dump bounds check). Impact: dump-time OOB writes on the dump device; requires root to configure the dump device and a crafted label64 on it → Low. Confidence: certain.

• Live (run.log): crafted label64 with d_bbase = 32 GiB inside a 1024-sector slice; DIOCGPART on /dev/vn1s1 returned media_blocks=1024, reserved_blocks=67,108,864 — the two operands disk_dumpcheck() (sys/kern/subr_disk.c:909) subtracts. 1024 − 67108864 wraps to 18,446,744,073,642,443,776, which is the size that diskdump() compares ap->a_offset + ap->a_length - offset against (subr_disk.c:1288-1296) — the check can never reject. A crash dump configured on such a slice writes past the partition end.
• The label path is unvalidated on read: l64_readdisklabel() checks only magic/npartitions/CRC (sys/kern/subr_disklabel64.c:174-196); ds_reserved = d_bbase / secsize (subr_disklabel64.c:521-527).
• Not executed to an actual OOB dump write (that would require crashing the guest with this slice configured as dumpdev); the arithmetic and its inputs are demonstrated exactly.
• Secondary (same function): di.mediaoffset/mediasize are scaled by DEV_BSIZE although blkno/size are in media blocks (subr_disk.c:935-936) → wrong dump geometry for non-512B sector media.

Suggested fix

In disk_dumpcheck(): reject reserved >= blocks (if (pinfo.reserved_blocks >= pinfo.media_blocks) return (EINVAL);) and compute offsets/sizes in secsize units; optionally validate d_bbase in l64_readdisklabel against the slice size.