DF-3211 — md_lookup_swap() decodes only the low 32 bits of the 64-bit NFSv3 file size into a signed int → negative / truncated swap size

File: sys/vfs/nfs/nfs_mountrpc.c:286, 292-299; consumer sys/vfs/nfs/nfs_vfsops.c:666-701, sys/vm/vm_swap.c (swaponvp takes u_quad_t).

What

NFSv3 fattr.size is a 64-bit hyper (wire words [5]=hi, [6]=lo — sys/vfs/nfs/nfsproto.h:325 nfsuint64 nfsv3fa_size after type/mode/nlink/uid/gid). md_lookup_swap reads only:

size = fxdr_unsigned(u_int32_t, fattribs.v3[6]);   /* :286 — low word only, into int */
...
nfsv3_diskless.swap_nblks = size / 1024;           /* :296 — signed division */

• swap file with size mod 2^32 in [2^31, 2^32) (e.g. a 2–4 GiB swap file) → size negative → swap_nblks negative.
• swap file ≥ 4 GiB → size silently wrong (mod 2^32): e.g. 8 GiB → 0 → swap silently disabled.
• NFSv2 path has the same signed-int landing (:292, v2 size is a u32 word [5]): ≥ 2 GiB v2 swap file → negative swap_nblks.

Downstream (nfs_mountroot, nfs_vfsops.c:666-701)

if (nd->swap_nblks) — a negative value is truthy → swap_nblks *= 2 (still negative) → VTONFS(vp)->n_size = nd->swap_nblks * DEV_BSIZE — negative file size on the swap vnode → swaponvp(td, vp, nd->swap_nblks) — the int sign-extends into swaponvp's u_quad_t nblks (sys/vm/vm_swap.c) → swap accounting believes ~2^64 blocks exist on an NFS file. Corrupt swap geometry / bogus vm_swap_size at best; boot-time failure at worst.

Threat

Trigger: a legitimate NFS server exporting a >2 GiB swap file (misconfig-sized or simply large), or — per DF-3205 — any LAN forger answering the boot LOOKUP (xid is deterministic, source unfiltered). Impact ceiling: boot-path DoS / swap-accounting corruption. Not runtime reachable post-boot.

Fix

Decode the full hyper (fxdr_hyper(&fattribs.v3[5]), xdr_subs.h:83) and bound-check before storing into the int field (see fix.diff).

VERDICT — DF-3211

status: untested (boot-path-only; not runtime-testable on the audit guest) impact: dos (boot-path: corrupt/negative swap geometry, boot failure; forged-reply vector covered by DF-3205's ceiling) confidence: certain (arithmetic proof; downstream behavior described from source)

Proof chain (path:line)

1. sys/vfs/nfs/nfsproto.h:306-335 — v3 fattr wire layout: fa_type[0], fa_mode[1], fa_nlink[2], fa_uid[3], fa_gid[4], nfsv3fa_size[5..6] (nfsuint64), … — size is a 64-bit hyper spanning words 5-6.
2. sys/vfs/nfs/nfs_mountrpc.c:283-286 — reply fattr decoded into fattribs.v3[21], then size = fxdr_unsigned(u_int32_t, fattribs.v3[6]); — only word [6] (low 32 bits) is read, high word [5] discarded; destination int size (:227) is signed. * low word ∈ [2^31, 2^32) → size < 0 (e.g. swap file of 3 GiB → low word 0xC0000000 → size = -1073741824). * file ≥ 4 GiB → wraps mod 2^32 (8 GiB → low word 0 → swap "disabled").
3. sys/vfs/nfs/nfs_mountrpc.c:295-296 — nfsv3_diskless.swap_nblks = size / 1024; — swap_nblks is int (sys/vfs/nfs/nfsdiskless.h:70) → negative KB for the 2–4 GiB window. v2 twin at :292: fxdr_unsigned(u_int32_t, fattribs.v2[5]) into the same signed size (v2 fattr size is u32 at word [5], nfsproto.h:314) — same negative landing for ≥2 GiB.
4. Consumer sys/vfs/nfs/nfs_vfsops.c:666-701 — if (nd->swap_nblks) (negative = true) → nd->swap_nblks *= 2 (:669) → VTONFS(vp)->n_size = VTONFS(vp)->n_vattr.va_size = nd->swap_nblks * DEV_BSIZE; (:691-692) — negative size on a VREG swap vnode → swaponvp(td, vp, nd->swap_nblks) (:701) where the parameter is u_quad_t nblks (sys/vm/vm_swap.c) — sign extension to ≈2^64 blocks feeding the swap bitmap/accounting.
5. sys/vfs/nfs/xdr_subs.h:83-84 — fxdr_hyper(f) exists and is the intended decoder for words [5..6]; other consumers (e.g. nfs_subs.c attribute handling) use it for exactly this field.

Why untested

Executes only during nfs_mountroot boot with an NFS root + swap path (#if BOOTP||NFS_ROOT). Audit guest (DragonFly 6.5-DEVELOPMENT #0, X86_64_GENERIC) boots hammer2 from disk; no runtime path reaches md_lookup_swap. Trigger on a real diskless client requires either a >2 GiB server swap file (plausible misconfig) or the DF-3205 forged-LOOKUP vector.

Impact assessment

Worst realistic: corrupt swap geometry at boot (negative vnode size, ~2^64-block swap claim) → boot failure / vm accounting corruption — boot-path DoS ceiling. No post-boot runtime reachability, no memory-safety primitive (values flow into sizes/counts, not pointers or copy lengths).

Recommended fix

Decode the full 64-bit size and range-check before storing (see fix.diff).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.