DF-2903 — Ontrack branch releases a pbuf via brelse() → panic from crafted MBR

What

mbrinit()'s "Ontrack Disk Manager" path (sys/kern/subr_diskmbr.c:174-182) does:

bp->b_flags |= B_INVAL | B_AGE;
brelse(bp);              /* bp is a getpbuf_mem() PBUF — must be relpbuf()! */
mbr_offset = 63;
goto reread_mbr;

bp comes from getpbuf_mem() (subr_diskmbr.c:127) — a paging buffer with B_PAGING set (vm/vm_pager.c:387). Releasing it through brelse() is a buffer-subsystem violation: on INVARIANTS kernels brelse()'s KASSERT(!(bp->b_flags & (B_CLUSTER|B_PAGING))) (vfs_bio.c:1275) panics immediately; on production (non-INVARIANTS) kernels the pbuf is handed to the buffer-cache free machinery while the pbuf subsystem still owns it — cross-subsystem buffer lifecycle corruption plus one pbuf leaked out of bswlist_mem per attach (eventual getpbuf_mem() exhaustion wedging all paging/probe I/O).

History: the FreeBSD original used geteblk() (a normal buffer, where brelse is correct). DragonFly converted the reads to getpbuf_mem() and fixed the done: path to relpbuf() (subr_diskmbr.c:316) but missed the Ontrack branch.

Observed (stock INVARIANTS guest)

A single MBR partition-table entry of type 0x54 (DOSPTYP_ONTRACK) plus a valid 0x55AA magic panics the kernel at disk-probe time:

panic: brelse: inappropriate B_PAGING or B_CLUSTER bp 0xfffff8004f3df690
brelse() at brelse+0x7f2
mbrinit() at mbrinit+0x1ae
disk_probe() at disk_probe+0x85
disk_msg_core() at disk_msg_core+0x252

(panic.txt — reproduced 2026-09-03, trigger: vnconfig -c vn0 ontrack.img.)

Secondary latent bug (same branch): once the release is fixed to relpbuf(), the goto reread_mbr loop is unbounded — an Ontrack entry also present at LBA 63 (offset 63*512) makes mbrinit re-read forever, wedging disk_msg_core which holds ds_token (subr_disk.c:512) → every subsequent open of any disk device in the system blocks forever. The fix therefore also makes the re-read one-shot (mbr_offset == DOSBBSECTOR).

Threat

Runs with kernel privilege at disk attach: USB plug-in auto-probe (devd/CAM), boot-time probe of an Ontrack-formatted disk, or root vnconfig of a crafted image. One crafted sector = guaranteed panic (INVARIANTS) / buffer-subsystem corruption (production).

Reproduce (guest, root)

python3 mkontrack.py                    # or use the shipped ontrack.img
vnconfig -c -v -S 512 vn0 ontrack.img   # stock kernel: instant panic (panic.txt)

Success criterion (stock): panic above; after fix.diff: attach completes cleanly, /dev/vn0s1 appears, no panic (run_fix.log).

DF-2903 VERDICT

Status: reproduced — impact: panic (guaranteed kernel panic from one crafted MBR sector; DoS class).

How it reproduced

1. 32 KB image: MBR magic 0x55AA at offset 510, partition entry[0] type 0x54 (DOSPTYP_ONTRACK) at offset 450 (mkontrack.py). Same table also placed at LBA 63 for the re-read leg.
2. vnconfig -c -v -S 512 vn0 /root/ontrack.img on the stock INVARIANTS guest → immediate panic, serial console (panic.txt): panic: brelse: inappropriate B_PAGING or B_CLUSTER with the exact stack brelse ← mbrinit ← disk_probe ← disk_msg_core. The synchronous probe (disk_setdiskinfo_sync, vn.c:584/869) runs mbrinit in the disk core thread; the Ontrack branch (subr_diskmbr.c:178-179) calls brelse() on the getpbuf_mem() pbuf from :127.
3. Post-panic the guest was catatonic (vm.sh status → down; new ssh connections timed out during banner exchange).

Reachability

• USB mass-storage plug-in: CAM auto-probes as root — no user action needed beyond physical insertion of crafted media.
• Boot with an Ontrack-managed disk (0x54 was a real-world Disk Manager convention, still honored here).
• Root vnconfig (used for the PoC).

Non-INVARIANTS behavior (reasoned, not run)

KASSERT compiles out; brelse() then inserts the B_PAGING pbuf into buffer-cache queues (vfs_bio.c:1268+): one pbuf leaked from bswlist_mem per Ontrack attach (cross-subsystem lifecycle corruption; replug loop → getpbuf_mem() exhaustion → permanent paging/probe wedge). The primary, demonstrated impact is the INVARIANTS panic.

Fix validation (this run)

fix.diff hunk 2: relpbuf(bp, NULL) + one-shot re-read guard (mbr_offset == DOSBBSECTOR). Patched kernel (built in-guest with make nativekernel): vnconfig of ontrack.img completes cleanly, slices are created, guest stays up (run_fix.log). Baseline panic vs patched clean-attach recorded side by side in this pack.