DF-3023 — tmpfs_write: negative pwrite offset → tmpfs_reg_resize(negative) → kernel panic

What

tmpfs_write() (sys/vfs/tmpfs/tmpfs_vnops.c:666) — unlike its sibling tmpfs_read() (:559-560) — never rejects a negative uio_offset. sys_extpwrite() (sys/kern/sys_generic.c:360-385) passes the user-supplied pwrite() offset through completely unvalidated (only nbyte < 0 is checked), so an unprivileged user can reach tmpfs_write() with uio_offset < 0.

Because struct uio.uio_resid is an unsigned size_t (sys/sys/_uio.h:59), every limit check in tmpfs_write is evaluated in unsigned 64-bit arithmetic and wraps mod 2^64:

• entry check uio_offset + uio_resid > tm_maxfilesize (:713-717): with uio_offset = -32752 and uio_resid = 32752 the sum wraps to exactly 0 → the EFBIG check passes;
• RLIMIT_FSIZE check (:726-730): same wrap → passes;
• per-iteration growth check (uio_offset + len) > tn_size (:760-766): iteration 1 computes len = 16368, and -32752 + 16368 = -16384 becomes a huge unsigned value → resize is requested with tmpfs_reg_resize(vp, (off_t)-16384, ...).

tmpfs_reg_resize() then hits KKASSERT(newsize >= 0) (sys/vfs/tmpfs/tmpfs_subr.c:990) and panics the kernel:

panic: assertion "newsize >= 0" failed in tmpfs_reg_resize at /usr/src/sys/vfs/tmpfs/tmpfs_subr.c:990
tmpfs_reg_resize() at tmpfs_reg_resize+0x2e9
tmpfs_write() at tmpfs_write+0x170
vop_write() at vop_write+0x9d
vn_write() at vn_write+0x134
kern_pwritev() at kern_pwritev+0xf2

Trigger

Unprivileged, single syscall, default tmpfs /tmp:

int fd = open("/tmp/x", O_CREAT|O_RDWR|O_TRUNC, 0644);
pwrite(fd, buf, 32752, -32752);   /* panics */

Variants observed on the guest

Production (non-INVARIANTS) kernels

The two KKASSERTs compile out; round_page64(-16384)/PAGE_SIZE (sys/sys/param.h:411) evaluates to a huge page count which trips the tm_pages_used + newpages > tm_pages_max ENOSPC check (tmpfs_subr.c:1007-1010) → the write fails cleanly with ENOSPC and no state is modified. So the memory-safety impact is confined to INVARIANTS/DEBUG kernels; production gets a wrong errno (ENOSPC instead of EINVAL) only.

Reproduction record

• run.log + panic.txt (serial console, fresh boot): probe EFAULT, then panic at tmpfs_subr.c:990, guest down at db>.
• Reproduced twice from clean-snapshot boots (vm.sh reset).
• boot_panic_raw.txt — first occurrence (identical signature).

Fix

fix.diff — one gate in tmpfs_write, mirroring tmpfs_read:559:

    if (uio->uio_offset < 0)
        return (EINVAL);

Validated in-guest with a rebuilt kernel: see "Fix validation" in VERDICT.md.

DF-3023 — VERDICT

Status: REPRODUCED (panic, unprivileged local DoS on INVARIANTS kernels) Fix: VALIDATED (single-fix kernel; bad behavior gone, no regression)

Reproduced — how and why

Unprivileged single pwrite() with a negative offset on the default tmpfs /tmp panics the kernel:

int fd = open("/tmp/x", O_CREAT|O_RDWR|O_TRUNC, 0644);
pwrite(fd, buf, 32752, -32752);          /* -> panic */

Root cause chain (all lines cited against the audited tree):

1. sys/kern/sys_generic.c:360-385 sys_extpwrite() copies the user offset into auio.uio_offset unvalidated (only nbyte < 0 checked); vn_write() (sys/kern/vfs_vnops.c:766-812) passes it through.
2. sys/vfs/tmpfs/tmpfs_vnops.c:666-943 tmpfs_write() — unlike tmpfs_read() at :559-560 — has no uio_offset < 0 rejection.
3. struct uio.uio_resid is unsigned size_t (sys/sys/_uio.h:59), so uio_offset + uio_resid is unsigned 64-bit arithmetic: * :713-717 EFBIG check: -32752 + 32752 == 0 (mod 2^64) → passes; * :726-730 RLIMIT_FSIZE check: same wrap → passes; * :760-766 growth check: -32752 + 16368 == -16384 → as unsigned huge → resize requested; tmpfs_reg_resize(vp, (off_t)-16384, 1).
4. sys/vfs/tmpfs/tmpfs_subr.c:990 KKASSERT(newsize >= 0) → panic.

Observed (fresh-boot serial console, panic.txt / run.log):

panic: assertion "newsize >= 0" failed in tmpfs_reg_resize at /usr/src/sys/vfs/tmpfs/tmpfs_subr.c:990
tmpfs_reg_resize() at tmpfs_reg_resize+0x2e9
tmpfs_write() at tmpfs_write+0x170
vop_write() at vop_write+0x9d
vn_write() at vn_write+0x134
kern_pwritev() at kern_pwritev+0xf2

Reproduced twice from clean-snapshot boots. The 16K-aligned single-block variant (pwrite(16384 @ -16384)) also passes every limit check but is stopped by the buffer cache: bread() at loffset −16384 fails with EFAULT ("tmpfs_write uiomove error 14" on console) — so no silent unaccounted-page primitive exists; the exploitable outcome is the panic.

Why it stops at a panic (impact ceiling)

• INVARIANTS/DEBUG kernels (this guest; dev/build machines): immediate unprivileged kernel panic — DoS. reproduced=true, impact=panic.
• Production (non-INVARIANTS) kernels: the two KKASSERTs compile out; round_page64(-16384)/PAGE_SIZE (sys/sys/param.h:411) yields a huge page count that trips the tm_pages_max ENOSPC guard (tmpfs_subr.c:1007-1010) → the write fails cleanly (wrong errno ENOSPC instead of EINVAL), no state change, no corruption.
• No path to uid=0: the resize target is fully kernel-derived (never attacker-data), and both the buffer cache (EFAULT) and the pages limit (ENOSPC) contain the non-panic variants. Exploit chain: none beyond DoS.

Fix validation

fix.diff = one gate in tmpfs_write mirroring tmpfs_read:559:

    if (uio->uio_offset < 0)
        return (EINVAL);

In-guest: patch -p0 into /usr/src, make -j6 nativekernel (BUILD_RC=0), make installkernel, reboot into DragonFly 6.5-DEVELOPMENT #1 (fix present at tmpfs_vnops.c:702).

• baseline: probe → EFAULT; panic trigger → kernel panic, guest down (×2)
• patched: probe → EINVAL; panic trigger → EINVAL; guest up; regression (write+pwrite+ftruncate) → correct 128-byte file.

Bad behavior gone; fix validated. See fix_build.log, run.patched.log.

Relationship to prior findings

• DF-2920/DF-2921 covered beyond-EOF page semantics (mmap/fault side) and HAMMER1 truncate-side signed overflow. DF-3023 is the write-syscall-side negative-offset entry into tmpfs resize — distinct root cause (missing uio_offset<0 gate + unsigned wrap in tmpfs_write's limit checks) and distinct fix.
• The positive-offset 2^63 variant of this idea is NOT exploitable: size_t uio_resid's unsigned promotion makes offset+resid wrap-free there (verified on guest: EFBIG). Only negative offsets (which skip the EFAULT/EFBIG behavior for aligned residuals) reach resize.