DF-3035 — FFS allocator trusts unvalidated on-disk cylinder-group headers

(sys/vfs/ufs/ffs_alloc.c) → attacker-offset OOB kernel read/write on a crafted filesystem image

What

Every allocator in sys/vfs/ufs/ffs_alloc.c reads a cylinder-group block with bread(), applies only cg_chkmagic() — a magic comparison (sys/vfs/ufs/fs.h:398) — and then uses raw on-disk cg-header fields as byte offsets into the cg buffer and array indexes into kernel memory:

The mount path never validates a single one of these fields (ffs_mountfs checks only fs_magic/fs_bsize, ffs_vfsops.c:642-646), and nothing re-checks them when the cg block is read at allocation time. Nothing checks them at free time either (ffs_blkfree_cg, ffs_freefile).

Additionally, inconsistent-but-in-range cg metadata (per-cg cg_cs vs fs_cstotal, bitmap vs counters) converts the kernel's own consistency panic()s into fail-stop DoS from a crafted image: ffs_valloc:630 (dup alloc), ffs_nodealloccg:1451 (block not in map), ffs_blkfree_cg:1542/1581 (freeing free block/frag), ffs_clusteralloc:1317 (map mismatch).

Threat model

Crafted FFS media mounted by root (same model as DF-0820 / DF-3015). The unprivileged trigger afterwards is a single creat/write in the mounted filesystem — the very first allocation touches the poisoned cg. On systems with vfs.usermount=1 (or in any scenario where an unprivileged user can get a crafted image mounted — e.g. removable media auto-mounting), this becomes unprivileged-user → arbitrary-offset kernel memory corruption.

Primitive (verified on the guest, stock INVARIANTS kernel)

• cg_cgx = 0x40000000 → deterministic Fatal trap 12, supervisor write, page not present, in ffs_clusteracct: Stopped at ffs_clusteracct.isra.0+0x1eb: movl %eax,(%rdx,%rcx,4) — the store fs->fs_maxcluster[cg_cgx] = i at base + 4·cg_cgx (panic1/2/3.txt). The same value three times → three fault addresses base + 0x1_0000_0000, with boot-varying heap bases.
• cg_iusedoff = 0x20000000 → deterministic Fatal trap 12, supervisor read, in ffs_nodealloccg: Stopped at ffs_nodealloccg+0x13f: movzbl (%rdi,%rax,1),%ecx — the inosused[ipref] bitmap read at cgbuf + 0x20000000 (panic4.txt).
• Control run (identical image, no field patched) → allocation succeeds, no panic (run.setup.log, run.log).

A cg_cgx that lands on mapped memory instead of the guard page yields a silent single-int32 inc/dec at an attacker-chosen ±offset — a corruption primitive, not a crash.

Reproduce (baseline, stock kernel)

# on the host, from the repo root:
tar czf /tmp/p.tgz -C findings/poc/DF-3035 cgxtool.c setup3035.sh fs.h dinode.h
ssh -F dfbsd-qemu/config dfbsd '/bin/sh -c "mkdir -p /root/poc && cat > /tmp/p.tgz && tar xzf /tmp/p.tgz -C /root/poc && cc -O -o /tmp/cgxtool /root/poc/cgxtool.c"'

# in the guest (root):
sh /root/poc/setup3035.sh cgx 0x40000000      # panics in ffs_clusteracct (write)
sh /root/poc/setup3035.sh iusedoff 0x20000000 # panics in ffs_nodealloccg (read)
sh /root/poc/setup3035.sh cgx none            # control: no panic (see script)

# panic evidence: dfbsd-qemu/vm.sh log  (serial console)

Expected baseline: Fatal trap 12: page fault while in kernel mode, fault code supervisor write data, page not present (cgx) or supervisor read data, page not present (iusedoff), guest drops to db>.

Expected with fix.diff (validated, run.patched.log): no panic; dd: /mnt/t0: No space left on device — the poisoned cg is rejected (ffs_chkcg) and the allocator fails gracefully with ENOSPC; a clean filesystem still allocates normally.

DF-3035 — VERDICT

Status: reproduced (impact: kernel memory corruption, attacker-offset OOB read + write; panic used as the observable). Fix validated: fixed.

What was tested

sys/vfs/ufs/ffs_alloc.c — every allocation/free path in the FFS allocator reads the on-disk cylinder-group header and uses its fields (cg_cgx, cg_freeoff, cg_iusedoff, cg_boff, cg_btotoff, cg_clustersumoff, cg_clusteroff, cg_rotor, cg_frotor, cg_irotor, cg_nclusterblks) as raw kernel-memory offsets/indexes after nothing more than cg_chkmagic() (fs.h:398 — a magic comparison). Mount-time validation does not exist for these fields (ffs_vfsops.c:642-646 checks only fs_magic and fs_bsize bounds).

Baseline runs (stock INVARIANTS kernel, guest

DragonFly dfbsd 6.5-DEVELOPMENT ... #1: Mon Jun 29 14:18:01 UTC 2026)

All runs use a 128 MB image built by the guest's own newfs (UFS1, 1 cylinder group, bsize 16384 / fsize 2048 / frag 8, contigsumsize 7), with one 32-bit field of cg0's on-disk header patched by cgxtool (offsets computed from the image's own superblock). The mount itself never reads cg headers, so the crafted image mounts read-write without complaint; the first allocation on it executes the poisoned path.

Why this is a write/read primitive, not "just a panic"

• The stopped instruction in runs 1–3 is the single indexed store fs->fs_maxcluster[cgp->cg_cgx] = i (ffs_alloc.c:1963): movl %eax,(%rdx,%rcx,4) — address = base + 4 × (int32 index). The index is the on-disk cg_cgx (here 0x40000000 → +4 GiB). The fault is only observed because the chosen offset lands on an unmapped page; any cg_cgx whose target is mapped yields a silent attacker-offset int32 store/inc/dec (fs_cs(cg_cgx).cs_nbfree-- at ffs_alloc.c:1213 is the same class, ±8 GiB reach). With the heap base ~0xfffff801xxxxxxxx, the reachable window covers the whole kernel heap and then some — signature: the three write faults sit at bootbase + 0x100000000 with boot-varying bases (0xfffff8011776a200, 0xfffff8008dbe3600, 0xfffff80118519500), matching fs_maxcluster + 4·cg_cgx in every run.
• Run 4's stopped instruction is inosused[ipref] (ffs_alloc.c:1415/ 1393) — a byte read at cgbuf + cg_iusedoff, here +512 MiB. The same pointer is later written through setbit(inosused, ipref) (ffs_alloc.c:1463) when a zero bit is found: read primitive first, write primitive on the same field.
• cg_freeoff/cg_boff/cg_btotoff/cg_clustersumoff/cg_clusteroff are the identical pattern for the block bitmap and cylinder/cluster arrays (bit-level writes at ±2 GiB, int16/int32 incs/decs) — traced in the finding table, not separately run: one field per boot is the observability limit (the first wild access traps), and the mechanism is line-for-line identical.

Exploitability assessment

• Trigger is a crafted filesystem image + one creat/write — the mount itself needs root (or vfs.usermount=1 setups / auto-mounting removable media, where the trigger becomes unprivileged).
• The primitive is a relative kernel-memory write with a ±8–32 GiB 32-bit-controlled displacement (csum dec/inc at 16-byte stride, fs_maxcluster store at 4-byte stride) plus bit-level writes through the bitmap offsets. No KASLR/SMAP/SMEP on this guest; heap base is boot-stable within a session, so a repeatable offset to a target object is realistic (e.g. point cg_cgx so that fs_csp[16·cg_cgx] lands on a neighbouring mount's fs_csp, function-pointer-bearing structures, or refcounts). A full uid0 chain was not developed because the mount already requires root on the default configuration — the ceiling is arbitrary kernel memory corruption from a malicious disk image (or unprivileged corruption wherever users can get their image mounted).
• The fail-stop panic()s reachable with in-range inconsistent cg metadata (ffs_valloc:630 dup alloc, ffs_nodealloccg:1451 block not in map, ffs_blkfree_cg:1542/1581 freeing free block/frag, ffs_clusteralloc:1317 map mismatch) make the same image a reliable local DoS even without an out-of-range field.

Fix validation

fix.diff adds ffs_chkcg() — validating cg_cgx against the cg's real index, rotors against their map sizes, and every map offset/size against fs_cgsize (with int64 math, ordered like the on-disk layout) — called after cg_chkmagic() in ffs_fragextend, ffs_alloccg, ffs_clusteralloc, ffs_nodealloccg, ffs_blkfree_cg, and ffs_freefile; plus a clamp of the preference-derived cg in ffs_hashalloc() before it indexes fs_csp[].

Applied to the guest's /usr/src, make nativekernel KERNCONF=X86_64_GENERIC (ffs_alloc.c compiled -Werror-clean), installed, rebooted (run.patched.log for the full sequence):

• identical cgx 0x40000000 image → no panic; dd fails No space left on device (poisoned cg rejected → allocator returns 0 → ENOSPC);
• identical iusedoff 0x20000000 image → no panic; same graceful ENOSPC;
• control (unpatched image) → first allocation still succeeds (legit filesystem unaffected), clean unmount.

Baseline bad behaviour GONE; legitimate allocation behaviour preserved.

Non-goals / notes

• DF-0793 (async-TRIM lifetime) and DF-0794 (fs_ncg==0) were given and are not re-verified here.
• Superblock-geometry div-by-zeros reachable from this file (fs_maxbpg==0 at ffs_blkpref:805, fs_spc/fs_nsect/fs_npsect in cbtocylno/cbtorpos, fs_frag>8 indexing fragtbl/around/ inside in ffs_mapsearch) are the DF-0820/DF-0794 family (mount-time superblock validation) and are not re-filed.