vm_contig_pg_alloc verify/alloc loops lack the vm_page_count bound — oversized size with permissive high reads one element past the end of vm_page_array
| Field | Value |
|---|---|
| ID | DF-2890 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-125 Out-of-bounds Read |
| File | sys/vm/vm_contig.c |
| Lines | 331-332, 377, 398 |
| Area | vm |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vm |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
The scan loop is bounded by v_page_count, but the successive-page
verify loop (for (i = start+1; i < start + size/PAGE_SIZE; i++)) and
the alloc loop have NO v_page_count bound. The only pre-check
(VM_PAGE_TO_PHYS(&pga[i]) + size) > high passes for arbitrarily huge
size with high == BUS_SPACE_MAXADDR (~0ULL), and phys+size can wrap,
defeating the clamp. A candidate free run reaching the last array
element reads pga[vm_page_count] — one element past vm_page_array —
(compare-only, no direct disclosure); each mismatch restarts at start+1,
so every start in the tail run repeats the OOB read and the scan
degenerates into an O(n²) rewalk plus three full page-queue flush
passes (long system-wide stall). No in-tree attacker-reachable caller
passes oversized size (cpuctl clamps; netmap/DRM gated) —
defense-in-depth bound + stall amplifier for buggy/coerced drivers.
Fix: reject candidates whose span cannot fit the array
(if (i + size/PAGE_SIZE > vmstats.v_page_count) break; at :308) and
harden :331 against phys+size wrap (phys > high - size after
size <= high).
Timeline
- 2026-09-02 Discovered during pass-2 audit of vm_contig.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2890 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 714 B | ↓ raw | |
| VERDICT.md | — | 2.1 KB | ↓ raw | |
| build.sh | — | 54 B | view raw | |
| dfv_safe.c | — | 21.8 KB | view raw | |
| env.txt | — | 401 B | view raw | |
| fix.diff | — | 831 B | view raw | |
| manifest.json | — | 649 B | view raw | |
| run.log | — | 784 B | view raw | |
| run.sh | — | 123 B | view raw | |
| verdict.json | — | 2.1 KB | view raw |
DF-2890 PoC evidence pack
What
vm_contig_pg_alloc verify/alloc loops lack a v_page_count bound: oversized size reads past the end of vm_page_array.
Build
make (KMOD dfv_safe)
Run
kldload dfv_safe.ko; sysctl -w dfv.cg2890=1; dmesg | grep DF2890
Expected
dmesg: OOB READ at idx >= v_page_count executed (4 samples); :331 pre-check PASSES for high=BUS_SPACE_MAXADDR
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).
DF-2890 - verification verdict
Status: reproduced | reproduced: 1 | impact: denial_of_service | confidence: likely
OOB read executed on the live kernel with an instrumented replica of the stock loops. With size = (v_page_count + 64) pages and high = BUS_SPACE_MAXADDR (0xFFFFFFFFFFFFFFFF, cpu/x86_64/include/bus_dma.h:47), the :331 pre-check (phys+size > high) PASSES (phys+size = 0x1e775e000), and the verify loop condition (i < start + size/PAGE_SIZE, vm_contig.c:377) has no v_page_count bound: with a tail candidate (start = v_page_count - 4) the loop read pga[998273]..pga[998276] - four REAL one-past-end reads at 0xfffff80047a04180.. executed (values returned to the harness log); the loop would otherwise run to index 1996606 = 2x the array. Compare-only OOB read of adjacent kernel memory (no disclosure channel); the practical impact is the O(n^2) rewalk plus 3 full page-queue flush passes stalling all contigmalloc callers. No in-tree attacker-reachable oversized caller (cpuctl clamps; DRM/netmap gated) - defense in depth.
Evidence pointers
run.log DF2890 lines: OOB READ idx=998275/998276 word0=0x0; pre-check PASSES; loop runs to 1996606
Kernel references
PoC changes vs the filing sketch
replica harness (function is static); reads limited to 4 past-end elements for safety
Fix
recommendation: bound both loops by vmstats.v_page_count and reject candidates whose span cannot fit the array
fix status: not_testable
fix compiled in fix-all kernel; replica logic shows fixed loop stops at v_page_count
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix compiled in fix-all kernel; replica logic shows fixed loop stops at v_page_count
Confirmed kernel references
Detail
Evidence (decisive lines)
run.log DF2890 lines: OOB READ idx=998275/998276 word0=0x0; pre-check PASSES; loop runs to 1996606
PoC changes
replica harness (function is static); reads limited to 4 past-end elements for safety
Verified recommended fix
bound both loops by vmstats.v_page_count and reject candidates whose span cannot fit the array
Verdict
OOB read executed on the live kernel with an instrumented replica of the stock loops. With size = (v_page_count + 64) pages and high = BUS_SPACE_MAXADDR (0xFFFFFFFFFFFFFFFF, cpu/x86_64/include/bus_dma.h:47), the :331 pre-check (phys+size > high) PASSES (phys+size = 0x1e775e000), and the verify loop condition (i < start + size/PAGE_SIZE, vm_contig.c:377) has no v_page_count bound: with a tail candidate (start = v_page_count - 4) the loop read pga[998273]..pga[998276] - four REAL one-past-end reads at 0xfffff80047a04180.. executed (values returned to the harness log); the loop would otherwise run to index 1996606 = 2x the array. Compare-only OOB read of adjacent kernel memory (no disclosure channel); the practical impact is the O(n^2) rewalk plus 3 full page-queue flush passes stalling all contigmalloc callers. No in-tree attacker-reachable oversized caller (cpuctl clamps; DRM/netmap gated) - defense in depth.
No comments yet.