DF-3050

s_blocks_count never checked against the device size — crafted superblock drives a ~256GB M_WAITOK kmalloc before any group-descriptor read, wedging the whole system

Field	Value
ID	DF-3050
Status	new
Severity	Medium
CVSS 3.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-770 / CWE-400
File	sys/vfs/ext2fs/ext2_vfsops.c
Lines	591-650
Area	vfs/ext2fs
Confidence	certain
Discovered	2026-09-02
Pass	2 (GLM 5.3 second pass)
Bucket	base:vfs
Reported	pending
Known CVE	none
CVE match	novel

Summary

ext2_compute_sb_data() allocates e2fs_gd = howmany(gcount,bsize/64)bsize and e2fs_contigdirs = gcount4 with M_WAITOK|M_ZERO directly after deriving gcount from the unvalidated s_blocks_count and before reading any group descriptor. With the supported 64BIT feature and bcount=0x7FFC00000000 a 4MB image passes every check and requests a 256GB allocation. Mount of a crafted image (root or vfs.usermount=1): VERIFIED a full-system wedge — mount(2) never returns, 'pagedaemon: WARNING! Continuous paging', guest dead to ssh until reset. Fix validated (bound bcount by the device media size via devvp->v_rdev->si_disk->d_info): instant EINVAL.

Timeline

2026-09-02 Discovered during pass-2 audit of ext2_vfsops.c (GLM 5.3); system-wide wedge reproduced + fix validated.

Discussion (0)

No comments yet.

Severity: Medium
Status: new
Bucket: Base system — filesystems
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-770
File: sys/vfs/ext2fs/ext2_vfsops.c
Lines: 591-650
Area: vfs
Discovered: 2026-09-05
Updated: 2026-09-05

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: dos
Confidence: certain
Tested: 2026-09-05 18:07:41
Attempts: 1
Runtime: 75s
Code hash: b5d33588bee27030
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: python3 craft.py df3050.img ; cc -O2 -o /root/vntool /root/vntool.c
Run cmd: /root/vntool attach 0 /root/df3050.img; mount -t ext2fs -o ro /dev/vn0 /mnt/e2

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-09-05 18:07:41
Runtime: —
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0 (same kernel; ext2fs.ko rebuilt with fix.diff hunk 3, 2026-09-05)
fix.diff: findings/poc/DF-3050/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3050 · 9 files

File	Type	Size
craft.py	—	1.8 KB	view raw
vntool.c	—	1.1 KB	view raw
run.sh	—	291 B	view raw
build.sh	—	156 B	view raw
run.log	—	597 B	view raw
hanglog.txt	—	193 B	view raw
fix_run.txt	—	466 B	view raw
env.txt	—	461 B	view raw
verdict.json	—	2.4 KB	view raw

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fixed module rejects the image immediately with EINVAL ('filesystem larger than device'); mount returns instantly, guest responsive (date command answered); pristine fs RW mount unaffected.

findings/poc/DF-3050/fix_run.txt; findings/poc/DF-3047/fix.diff (hunk 3)

↓ fix.diffDragonFly dfbsd 6.5-DEVELOPMENT #0 (same kernel; ext2fs.ko rebuilt with fix.diff hunk 3, 2026-09-05)

Confirmed kernel references

Detail

Exploit chain

crafted sb (64BIT, desc_size=64, bcount=0x7FFC00000000, valid bpg/ipg/fdb) -> mount -o ro -> ext2_compute_sb_data:647 kmalloc(2^38) M_WAITOK -> unsatisfiable -> eternal vm wait + page-daemon thrash -> system-wide DoS

Evidence (decisive lines)

run.log (full session), hanglog.txt (console pagedaemon warning), fix_run.txt (fixed: instant EINVAL, guest alive)

PoC changes

crafted from scratch: mke2fs 4MB base, patched feature_incompat |= 0x80, desc_size=64, blocks_count lo/hi, zeroed rb/fb counts; no checksums involved (^metadata_csum).

Verified recommended fix

reject s_blocks_count > device media blocks (si_disk->d_info) in ext2_compute_sb_data()

Verdict

s_blocks_count is never checked against the mounted device's size; a 4MB crafted 64BIT image claiming ~2^45 blocks passes all mount checks and reaches kmalloc(~256GB, M_WAITOK|M_ZERO) before any group-descriptor read. Reproduced: mount(2) never returned, console showed 'pagedaemon: WARNING! Continuous paging', guest fully wedged until reset.