DF-3144

hpfs_cpinit mount-time livelock: 'while (cpicnt > 0)' never terminates when every cpisec carries s_cpicnt == 0 and s_next chains (self-loop)

Summary

cpicnt (from sp_cpinum) is only decremented inside 'for (i=0; i<cpisp->s_cpicnt; i++, cpicnt--)' (:292); s_cpicnt and s_next are raw on-disk fields and CPI_MAGIC is never checked. With sp_cpinum>=1 and a cpisec with s_cpicnt==0/s_next=self, mount(2) breads the same sector forever inside hpfs_cpinit. Mounting a crafted/corrupted HPFS image (root or vfs.usermount=1): mount never completes and cannot be aborted (unkillable), guest degrades. VERIFIED: no MOUNT_RC ever, inner timeout(15) could not kill mount(2), outer ssh killed at 30s, follow-up ssh banner-timeout; guest force-killed. Fix: cap the cpisec-chain iteration count (e.g. 16) -> EINVAL (diff in pack; also fixes DF-3145).

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — filesystems
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-835
File: sys/vfs/hpfs/hpfs_subr.c
Lines: 282-305
Area: vfs
Discovered: 2026-09-07
Updated: 2026-09-07

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: dos
Confidence: certain
Tested: 2026-09-07 03:18:35
Attempts: 1
Runtime: 300s
Code hash: 7cf28fcea5ce72b6
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 x86_64 (stock)
Build cmd: ./build.sh
Run cmd: ./run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-09-07 03:18:35
Runtime: —
Kernel: per-fix-DF-3144
fix.diff: findings/poc/DF-3144/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3144 · 5 files

File	Type	Size
craft_img.py	—	2.2 KB	view raw
run.log	—	597 B	view raw
env.txt	—	150 B	view raw
fix.diff	—	662 B	view raw
build.log	—	158 B	view raw

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

not_testable (no patched-kernel run for this finding)

↓ fix.diffper-fix-DF-3144

Confirmed kernel references

sys/vfs/hpfs/hpfs_subr.c:282-305
sys/vfs/hpfs/hpfs.h:302-308

Detail

Evidence (decisive lines)

['run.log: SSH_RC=124 with no MOUNT_RC ever printed; banner-timeout probe; guest force-killed']

PoC changes

none (first attempt worked)

Verified recommended fix

Bound the cpisec-chain iteration count (fix.diff); also kfree hpm_cpdblk on the error returns (DF-3145)

Verdict

Reproduced on the stock kernel: mounting (as root, via direct mount(2)) an image with sp_cpinum=1 and a cpisec carrying s_cpicnt=0 / s_next=self hangs mount(2) forever inside hpfs_cpinit's bread loop. The inner timeout(15) could not terminate the mount; the outer ssh was killed at 30s; a follow-up ssh hit 'Connection timed out during banner exchange' (same sshd-starvation signature as DF-3143). Mount never completes and cannot be aborted; reboot required. cpisec magic (CPI_MAGIC) is never checked either, but the missing loop bound is the bug.