DF-3036
ffs_reallocblks reads start_ap[-1] (stack OOB) when a cluster spans direct→indirect blocks — DIAGNOSTIC-only
| Field | Value |
|---|---|
| ID | DF-3036 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-125 |
| File | sys/vfs/ufs/ffs_alloc.c |
| Lines | 430-433 (cf. guards :410, :512) |
| Area | vfs/ufs |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vfs |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
When start_lvl==0 (cluster begins in the direct block array) and the cluster's last block lands in an indirect block (end_lvl>0 with end_ap[end_lvl−1].in_off+1 < len, e.g. LBNs 10-12 with UFS_NDADDR=12), the DIAGNOSTIC block evaluates start_ap[start_lvl−1].in_lbn == start_ap[−1].in_lbn — an out-of-bounds stack read below the indir array, plus a possible spurious 'ffs_reallocblk: start == end' panic from garbage. Reachable only in kernels built with 'options DIAGNOSTIC' (not the stock/INVARIANTS configuration); no effect on production kernels. Fix: guard the comparison with start_lvl > 0 (one-liner).
Timeline
- 2026-09-02 Discovered during pass-2 audit of ffs_alloc.c (GLM 5.3).
No comments yet.