DF-2831 — dssize()/diskpsize consume dp->d_slice without ds_token; DSO_RAWPSIZE fallback then substitutes whole-disk size for partitions

• Verified 2026-09-01, DragonFly 6.5-DEVELOPMENT x86_64 guest (QEMU/KVM), stock INVARIANTS kernel #0 Thu Jul 2 06:02:54 UTC 2026, then instrumented and fixed kernels built in-guest with make nativekernel.
• File: sys/kern/subr_diskslice.c (dssize :836-871), consumer wired from sys/kern/subr_disk.c diskpsize :1259-1276 (+ DSO_RAWPSIZE fallback :1270-1274), racing disk_probe replacement :367-368/:494 via disk_msg_core under ds_token.
• Bucket: memcorrupt. Severity: Medium. Confidence: certain.

TL;DR verdict

REPRODUCED on the stock guest: racing swapon (d_psize -> dssize) against root-forced reprobes (DIOCSYNCSLICEINFO arg=1) makes the kernel install a wrong swap geometry silently: 125-277 of every 2000 swapon cycles returned the whole-disk size (16384 blocks) for partition vn0s1a whose real label says 4096 blocks — verified against a same-instant DIOCGDINFO64 probe showing the in-core label was CORRECT (so the value did not come from the label). With kprintf instrumentation between the racy reads (build #1) the same race produced a fatal trap 12 page fault in dssize+0x15c (movq 0x40(%rax),%rax, fault addr 0x40) — the ENTER/WALK traces show dssize walking an older generation of struct diskslices (...6a00 vs current ...7c00) whose label/ops pointers were freed — the guest died at the ddb prompt. The token fix (diskpsize takes ds_token around dssize + dssize revalidates slice bounds) removes the UAF walk and, together with suppressing the DSO_RAWPSIZE whole-disk substitution for partition devices, drives the wrong-geometry anomalies to 0/2000 and 0/2000 with clean ENXIO failures instead (fix kernel #3).

Evidence

• run.log / fix_run.log — stock vs patched counters
• panic.txt — full serial console trace: DF2831 ENTER/WALK pointer generations, fatal trap 12, Stopped at dssize+0x15c
• fixinst trace (in VERDICT.md) — 219x "blocks=-1 nolabel" matched 1:1 with 219x "RAWPSIZE fallback -> raw whole-disk size" = provenance of the wrong value on the token-fixed kernel (label loss is the DF-2742 diskstrategy family; the fallback misdesign turns it into silent wrong geometry)
• fix.diff — ds_token in diskpsize + dssize/dsopen bounds revalidation + RAWPSIZE fallback restricted to whole-disk/whole-slice devices

Reproduce

see build.sh / run.sh. Root on the guest; ~90 s per 2000-iteration run.

DF-2831 VERDICT — full narrative

The bug

dssize() (sys/kern/subr_diskslice.c:836-871) snapshots *sspp (= dp->d_slice), checks slice < ssp->dss_nslices and the open mask on that snapshot, optionally re-opens the device (which can block and let a reprobe run), reloads ssp = *sspp, and then dereferences ssp->dss_slices[slice].ds_label / .ds_ops and calls ops->op_getpartbounds() — with no ds_token and no revalidation of the reloaded pointer. Its only caller diskpsize() (sys/kern/subr_disk.c: 1259-1276, the d_psize dispatch) also takes no token. Meanwhile disk_msg_core processes DISK_DISK_REPROBE (forced by root via DIOCSYNCSLICEINFO with arg != 0, which skips the open-busy check at subr_diskslice.c:627-644) by running disk_probe(), which replaces dp->d_slice with a fresh allocation (subr_disk.c:367-368, mbrinit realloc, gptinit realloc) and dsgone()s the old one (:494) — freeing the very struct dssize walks, together with its disklabel. dsopen() (subr_diskslice.c:761-777) additionally lacks the slice >= dss_nslices bounds check that every other entry point performs.

Sibling of DF-2742 (diskstrategy, same missing-serialization family) but a distinct sink (d_psize path) with its own fix site; DF-2742's recommended fix does not cover dssize/diskpsize.

How it was proven

1. Stock kernel #0, fresh vm.sh reset with-src: crafted MBR image (genimg2831.c) vnconfig'd to /dev/vn0 — one DFLYBSD slice s1 with a valid disklabel64 whose partition 'a' is 2 MiB (=4096 512-blocks). Racer: swapon("/dev/vn0s1a")+swapoff in a loop; hammer: ioctl DIOCSYNCSLICEINFO(1) on /dev/vn0 (~150-300k reprobes/run). Baseline without hammer: 2000/2000 clean, size always 4096. With hammer (3 independent stock runs): ok_WRONG_SIZE = 206/2000, 285/2000, 277/2000, 125/2000 — swapon succeeded with swapinfo reporting 16384 blocks (= whole-disk ds_size) while a same-instant DIOCGDINFO64 probe of /dev/vn0s1 showed the in-core label still says 'a' = 4096 blocks: the size did NOT come from the label.
2. Instrumented stock kernel #1 (kprintf between the racy reads only): serial console captured the two pointer generations diverging live — ENTER ... ssp=0xfffff8008d5d7c00 vs WALK ssp=0xfffff8008d5d6a00 with label=0xfffff8008edb5e80 — and then Fatal trap 12: page fault while in kernel mode ... fault virtual address = 0x40 ... Stopped at dssize+0x15c: movq 0x40(%rax),%rax — a stale ds_label/ds_ops read from the freed struct. Guest died at db> (panic.txt). This is the use-after-free read, caught mid-race.
3. Provenance of the silent wrong value (fix+instrumentation build #2, trace counts): 219/1500 anomalies, and dmesg showed exactly 219 DF2831 blocks=-1 nolabel vn0s1a matched 1:1 with 219 DF2831 RAWPSIZE fallback vn0s1a -> raw whole-disk size. Chain: the reprobe's own label re-read goes through diskstrategy (no ds_token — the DF-2742 window), hits the transient 2-slice struct, fails, and disk_probe_slice (subr_disk.c:324-332) then clears the slice's label; dssize correctly returns -1 for a labelless partition, and diskpsize's DSO_RAWPSIZE fallback (vn sets DSO_RAWPSIZE, vn.c:579) silently substitutes the raw whole-disk size for a partition device. swapon installs a 4x-oversized swap device on a 2 MiB partition.

Impact

• Unprivileged reachability: NO — both swapon and forced reprobe are root-only (diskopen enforces SYSCAP_RESTRICTEDROOT). This is a privileged-trigger race: root racing root, or root-forced reprobe vs automated swap management.
• Demonstrated: kernel use-after-free read (fatal trap 12), and silent wrong swap geometry (4x oversized swap on a partition; swap I/O past the real partition then fails/clamps at dscheck — corrupted swap bitmap accounting, potential page-loss/DoS). Latent: same-size-class recycling of the freed ssp/label can feed arbitrary kernel-object content into partition bounds (the instrumented trace shows benign recycled-label reads returning 4096 right up until the fault).
• Severity: Medium (local DoS/integrity with privileged trigger; memory-safety class UAF read).

Fix validation (kernel #3, final fix.diff)

• make nativekernel in guest, rebooted into #3 (fix_run.log).
• Same PoC, same churn: ok_WRONG_SIZE=0/2000 and 0/2000 (stock: 125-277), failures became clean, explicit ENXIO ("Device not configured") during the transient labelless windows — 703/887 occurrences — instead of a silent lie; no panic; no-hammer sanity 2000/2000 swapon OK; guest up throughout.
• Residual: the transient label loss itself is the DF-2742 diskstrategy family (recommended fix there: ds_token around the dp->d_slice fetch + dscheck, and in disk_invalidate). With DF-2742 fixed, the ENXIO transients disappear too; DF-2831's own fix stands alone and correct regardless.

Kernel references

• sys/kern/subr_diskslice.c:849-870 (dssize unsynchronized walk + missing revalidation — the audited file)
• sys/kern/subr_diskslice.c:761-777 (dsopen missing slice bounds check)
• sys/kern/subr_disk.c:1259-1276 (diskpsize, no ds_token), :1270-1274 (DSO_RAWPSIZE whole-disk substitution for partition devices)
• sys/kern/subr_disk.c:367-368,494 (replacement + dsgone under ds_token), :512-598 (disk_msg_core holds ds_token)
• sys/vm/vm_swap.c:307-317 (swaponvp consumer), sys/dev/disk/vn/vn.c:579 (DSO_RAWPSIZE)