DF-2956 — post-2107 tv_sec silently wraps year field / truncates to 32 bits in timespec2fattime

Where

sys/kern/subr_fattime.c:157 and :173 (timespec2fattime):

t2 = t1 / DAY;          /* :157  int64 -> unsigned 32-bit TRUNCATION */
...
l = t2 / LYC;
*ddp = (l * 4) << 9;    /* :173  year field is 7 bits; l*4 > 127 wraps mod 2^16 */

Two stacked overflows on the write path:

1. Year-field width: dates past 2107-12-31 need l*4 > 127; (l*4)<<9 wraps modulo 2^16 when stored into the uint16_t date word, aliasing far-future dates onto arbitrary dates in 1980..2107.
2. 64→32 truncation: for tv_sec >= 2^32*86400 (~year 14.5M) the unsigned t2 = t1 / DAY assignment truncates, aliasing astronomically far dates onto arbitrary recent ones.

Reachable by an unprivileged file owner: itimespecfix (sys/kern/kern_time.c:1047) enforces only tv_sec >= 0, no upper bound; kern_futimens gates on file-owner-or-write (vfs_syscalls.c:3847); msdosfs_setattr (msdosfs_vnops.c:400-421) allows explicit utimes when cr_uid == pmp->pm_uid — i.e. any user-uid-mounted msdosfs (desktop removable-media automounts use the console user's uid).

Distinct from known DF-0200 (which is the negative tv_sec path).

Observed (stock INVARIANTS kernel #0)

A timestamp of year ~4.4 million is silently stored and reported as 2023-11-23 05:22:06 — indistinguishable from a genuine recent mtime.

Reproduce

Same procedure as DF-2955 (see run.sh); use the X cases:

./fattime_poc /mnt/X1 4354819200       # 2108-01-01 -> 1980-01-01
./fattime_poc /mnt/X3 140737488355327  # year 4.4M  -> 2023-11-23
umount /mnt && ./findentry /tmp/fat.img X1   # MDate bytes 21 00

Fix

fix.diff adds a saturating clamp after t2 -= T1980:

if (t2 > T2107)     /* ((2108-1980)*YEAR + 31 - 1) */
    t2 = T2107;

Validated on rebuilt kernel #1: all post-2107 inputs saturate to 2107-12-31 (preserving time-of-day), on-disk encoding 0xff9f; the 1980/2023 aliases are gone (poc_fixed.log).

DF-2956 VERDICT

status: reproduced (impact: timestamp-integrity / correctness — no memory corruption; per the honest-impact enum this maps to impact: none)

What was run

Same guest/session as DF-2955 (stock kernel #0 → patched #1).

1. Math harness (harness_guest.log section B): timespec2fattime with post-2107 tv_sec: - 2108-01-01 → dd=0x0021 (1980-01-01) - 4147-08-08 → dd=0xeef8 → decodes 2099-07-24 - year 5236 → dd=0x705c → decodes 2036-02-28 - year 4461763 (2^47-ish) → dd=0x5777 → decodes 2023-11-23 - 2^62 → dd=0xf450 → decodes 2102-02-16

2. End-to-end kernel PoC (poc_root.log): on the real msdosfs mount, utimes() with explicit times: - X1 4354819200 (2108-01-01) → stat 1980-01-01 00:00:00; on-disk entry bytes 24-25 = 21 00 → MDate=0x0021 (findentry.log) — bit-for-bit the harness prediction. - X2 68718441600 (4147) → stat 2099-07-24. - X3 140737488355327 (year 4,461,763) → stat 2023-11-23 05:22:06; on-disk MDate=0x5777 (2023-11-23) — the 64→32 truncation of t2 = t1 / DAY (subr_fattime.c:157) aliases an absurd timestamp onto a plausible recent one.

3. Unprivileged (poc_unpriv.log): mount_msdos -u 1001 + run as uid 1001 (file owner) → X-case MISMATCHs identical, no root.

Root cause chain

utimes/futimens (no upper bound: itimespecfix kern_time.c:1047-1052; owner/write gate: vfs_syscalls.c:3847 naccess_lva(NLC_OWN|NLC_WRITE)) → msdosfs_setattr (msdosfs_vnops.c:419-420; allowed when cr_uid == pm_uid) → timespec2fattime (sys/kern/subr_fattime.c:139): t2 = t1 / DAY truncates int64→uint32 (:157); (l * 4) << 9 overflows the 7-bit year field into the 16-bit *ddp (:173) for l4 > 127. Result: far-future dates persist as arbitrary* dates in 1980..2107 with no error.

Distinct from known DF-0200 (negative tv_sec path; here tv_sec is positive and huge).

Why not higher severity

Writes only wrap into the caller's uint16_t date word (defined unsigned wrap; table walks bounded m ≤ 47 — no OOB). Downstream table decomposition remains in-bounds for any truncated t2 (verified by construction and fuzzing the harness with t1 up to 2^62). Silent timestamp fabrication (integrity), same class as DF-0199/DF-0200 (Low).

Fix validation

fix.diff adds #define T2107 ((2108-1980)*YEAR + 31 - 1) and saturates t2 > T2107 → T2107 before the 2100 adjustment (plus the DF-2955 hunk; one rebuild validated both).

Patched kernel #1 (poc_fixed.log): - X1 2108-01-01 → stat 2107-12-31 00:00:00, on-disk MDate=0xff9f (maximal representable FAT date). - X2 → 2107-12-31 08:00:00 (time-of-day preserved). - X3 → 2107-12-31 05:22:06 — the 2023-11-23 alias is gone.

fix_status: fixed.

Guest was reset (vm.sh reset with-src) after validation.