DF-3139 — al_len == 0 alleaf treated as an infinite extent by hpfs_hpbmap: unprivileged arbitrary raw-device sector read/write

Build

./build.sh      # crafts df3139.img on host, pushes + compiles on guest

Run

./run.sh        # mounts RW on uid-1001-owned mountpoint, runs the PoC
                # as uid 1001, then (root) dumps raw sector 0x30

Expected (and observed)

DF3139 read  sector 0x10 via file offset 0x200000:
    first8 = 0xfa53e9c5f995e849   (the HPFS SUPERBLOCK magic — read
                                    through a file that owns 0 blocks)
DF3139 read  sector 0x30 via file offset 0x204000:
    first4 = 0x00000038           (the bitmap-dir word)
DF3139 write sector 0x30 via file offset 0x204000: rc=512
raw /dev/vn0 sector 0x30 afterwards: "DF3139-PWNED-RAW-SECTOR-WRITE"

Root cause: sys/vfs/hpfs/hpfs_alsubr.c:118-119 — if ((bn >= alp->al_off) && (!alp->al_len || (bn < al_off+al_len))) treats a zero-length alleaf as matching every bn >= al_off, and :122 maps it to *bnp = bn - al_off + al_lsn on the raw device vnode (h_devvp). With al_off/al_lsn crafted, every file offset maps to a chosen raw sector of the whole backing device — reading/writing the superblock, disklabel area, or (on multi-slice disks) other partitions' data from an unprivileged pread/pwrite on an ordinary file. Distinct from DF-3099 (hpfs_write's (runl+1)*DEV_BSIZE arithmetic; the feed is this branch's *runp = 3, but the arbitrary-device-addressing consequence of the !alp->al_len clause itself is this finding).

DF-3139 VERDICT — REPRODUCED (unprivileged arbitrary raw-device sector read + write through a file descriptor)

Observed (run.log, guest DragonFly 6.5-DEVELOPMENT X86_64_GENERIC)

Crafted image: file FILE, fn_size = 4 MB, root alblk = single alleaf {al_off=0x1000, al_len=0, al_lsn=0x10}; mounted RW via direct mount(2) on a uid-1001 mountpoint. Executed as uid 1001 (maxx):

1. pread(fd, 512, 0x200000) -> lbn 0x1000 -> sector 0x10: returned the SUPERBLOCK, first 8 bytes = 0xfa53e9c5f995e849 (su_magic).
2. pread(fd, 512, 0x204000) -> lbn 0x1020 -> sector 0x30: returned 0x00000038 (the bitmap-dir pointer word stored there).
3. pwrite(fd, "DF3139-PWNED-RAW-SECTOR-WRITE", 0x204000) -> rc=512.
4. Root-side raw dump of /dev/vn0 sector 0x30 afterwards contains "DF3139-PWNED-RAW-SECTOR-WRITE" (hex 44 46 33 31 33 39 2d 50 57 4e 45 44 ...) — the unprivileged pwrite modified a raw device sector the file owns no allocation for (its declared allocation is ZERO blocks).
5. File pread afterwards returns the marker — the mapping is live.

The write path: hpfs_write -> hpfs_hpbmap (offset inside fn_size, so no extend/allocation happens) -> getblk/bread(hp->h_devvp, dbtodoff(bn)) -> uiomove — i.e. plain device-relative I/O at the crafted address. Aiming at sector 0x10 would have overwritten the mounted filesystem's superblock (we targeted the bitmap-dir sector instead to keep the mount usable; nothing restricts the target except bn >= al_off and the device size).

Impact

• On the audit guest: unprivileged destruction/disclosure of any sector of the backing device (dos-grade here — single-FS vn device).
• On a real system with the crafted image mounted (or via vfs.usermount): arbitrary read/write relative to the WHOLE disk device — other slices, other filesystems, disklabel — from an unprivileged file pwrite/pread. Filesystem-integrity and multi-tenant-disk confinement break; realistic host-compromise enabler when another slice holds the OS.

Fix validation

fix.diff (shared, DF-3137 pack) drops the !alp->al_len || escape so a zero-length leaf matches nothing; patched kernel: the same pread/pwrite return EFBIG, raw sector 0x30 unchanged (fix_run.log).

Verdict

REPRODUCED — arbitrary raw-device sector read/write from unprivileged file I/O. Kernel refs: sys/vfs/hpfs/hpfs_alsubr.c:113-143 (leaf match + mapping), :118-119 (the !alp->al_len clause), :122 (*bnp arithmetic), sys/vfs/hpfs/hpfs_vnops.c:283-289 (VOP_BMAP exposure), :322-346 (read), :385-430 (write).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.