DF-3212 — ffs_read OOB read into buffer-cache KVA via dead xfersize guard (crafted fs_qbmask)

One line

An unprivileged read(2)/pread(2) at a valid file offset on a crafted-geometry UFS1 mount returns other kernel buffer-cache pages' contents (kernel .text/.rodata from the kernel-image file's cache pages, other files' data — e.g. /usr/sbin/ngctl string tables) or EFAULT, because the xfersize <= 0 panic guard in ffs_read() is dead code for exactly the case it exists for: the unsigned size_t promotion at ufs_readwrite.c:143 clamps the negative xfersize up to uio_resid before the guard, and uiomovebp(bp, bp->b_data + blkoffset, ...) then copies from up to fs_qbmask-width bytes past the buffer — into adjacent 64 KB buffer-cache KVA slots (sys/kern/vfs_bio.c:640: b_kvabase = vm_map_min(buffer_map) + MAXBSIZE * n).

Where

• sys/vfs/ufs/ufs_readwrite.c:141-155 (ffs_read xfersize math + dead guard + sink)
• geometry root cause shared with DF-0903/DF-3190 (unvalidated fs_qbmask, sys/vfs/ufs/ffs_vfsops.c:642-646 validation gap; ffs_oldfscompat re-derives masks only for fs_inodefmt < FS_44INODEFMT, ffs_vfsops.c:802-816) — but this is a different sink and a different primitive (read-side info leak vs write-side balloc panic / undersized-buffer overrun).

Reproduce (guest, root then unprivileged)

# setup as root (~1 min):
sh setup.sh          # builds craft_img + trigger, makes clean 8192/1024 UFS image,
                     # creates 1 MB zero file leak.bin, unmounts, patches fs_qbmask
                     # 0x1fff -> 0x7ffff, mounts crafted RW at /mnt/test
                     # (noatime,noclusterr)
# marker (optional root-only content to hunt for in the leak):
awk 'BEGIN{for(i=0;i<1000000;i++)printf "DF3212-ROOT-SECRET-%08d\n",i}' \
    > /root/.df3212_secret && chmod 600 /root/.df3212_secret
cat /root/.df3212_secret > /dev/null     # warm buffer cache

# decisive run as the unprivileged user:
su -m pwn -c /tmp/trigger2 /mnt/test/leak.bin

Expected

• Control (clean image base.img mounted on /dev/vn1): every pread returns 512 zero bytes (file is all zeros) — SUMMARY nonzero=0 clean=15 efault=0.
• Stock kernel + crafted image: n=-1 errno=14 EFAULT for unmapped adjacent slots AND NON-ZERO KERNEL DATA windows for mapped ones — kernel .rodata format strings (ahci_get_err_ccb: ci not 0 (%08x), ...rejected because of the security policy), raw kernel .text (x86-64, rip-relative), and other files' cached pages (ngctl help strings). Stable counts across runs (nonzero=2/10 clean=3 efault=10/22 for trigger/trigger2).
• Fixed kernel (fix.diff): every crafted-offset pread returns -1 errno=5 (EIO), control still returns zeros, no leak, no panic.

Files

• craft_img.c — superblock fs_qbmask patcher (file offset SBOFF+1336)
• trigger.c — 15-slot single-offset prober (k*0x10000+0x123)
• trigger2.c — 7-slot × 5-page scanner with hexdump + marker search
• setup.sh / run.sh — guest orchestration
• fix.diff — in-file guard (blkoffset >= bp->b_bufsize → EIO)
• logs: run.control_and_trig1.log, run2.trigger2.log, fix_build.log, fix_baseline_reproduced.log, fix_patched_run.log, env.txt

DF-3212 — VERDICT

Bottom line

REPRODUCED — kernel memory disclosure (info leak) via an out-of-bounds read in ffs_read() on a crafted-geometry UFS1 mount, triggered by a single unprivileged pread(2) at a valid file offset; fixed-kernel validation passed (surgical guard, no leak, no false positives on clean filesystems).

What was tested and how

Harness (reuses the DF-0903 pack mechanics)

• setup.sh (root): newfs -b 8192 -f 1024 image, 1 MB all-zero leak.bin created under clean geometry, clean unmount, then craft_img binary-patches fs_qbmask 0x1fff → 0x7ffff (file offset SBOFF+1336) and the image is mounted RW (mount -o noatime,noclusterr). Mount succeeds — stock ffs_mountfs validates only magic/bsize bounds (sys/vfs/ufs/ffs_vfsops.c:642-646) and ffs_oldfscompat re-derives masks only for fs_inodefmt < FS_44INODEFMT (ffs_vfsops.c:802-816); modern newfs sets inodefmt=2 (verified in craft output).
• Trigger: unprivileged user (su -m pwn), pread(512) at offsets k*0x10000 + 0x123 (k=1..15) — all valid offsets inside the 1 MB file.

The bug (line-accurate)

sys/vfs/ufs/ufs_readwrite.c:141-155:

blkoffset = blkoff(fs, uio->uio_offset);     /* off & fs_qbmask -> up to 0x7FFFE */
xfersize = bp->b_bufsize - blkoffset;        /* 8192 - 0x50123 -> NEGATIVE      */
if (xfersize > uio->uio_resid)               /* int vs size_t: -330k -> huge    */
    xfersize = uio->uio_resid;               /* clamps to 512 — POSITIVE        */
if (xfersize > bytesinfile)                  /* fine                            */
    xfersize = bytesinfile;
if (xfersize <= 0)                           /* DEAD for this case              */
    panic("ufs_readwrite: impossible xfersize");
error = uiomovebp(bp, bp->b_data + blkoffset, xfersize, uio);  /* OOB SOURCE */

bp->b_bufsize comes from ffs_blkatoff_ra() → blksize(fs, ip, lbn) → fs_bsize (sys/vfs/ufs/ffs_subr.c:97-119), while blkoffset comes from the attacker's fs_qbmask — two independent derivations never cross-checked. The unsigned promotion at :143 converts the negative xfersize to a huge size_t, making the clamp TRUE and assigning a small positive value before the panic guard at :147 — the guard is dead code for exactly the negative case it was written for. uiomovebp then copies 512 bytes from b_data + k*64KB + 0x123. Every buffer owns a contiguous 64 KB KVA slot (sys/kern/vfs_bio.c:640, bp->b_kvabase = vm_map_min(buffer_map) + MAXBSIZE * n), so the source pointer lands in neighboring buffers' mapped pages (mapped → disclosure) or unmapped KVA (→ EFAULT from uiomove's on-fault window, kern_subr.c).

Observed (stock kernel #0, INVARIANTS, two guest lives)

• Control (clean base.img, same read pattern): 15/15 preads → 512 zero bytes (SUMMARY nonzero=0 clean=15 efault=0) — impossible-to-misread baseline.
• Crafted fs, life 1: trigger: nonzero=2 clean=3 efault=10 (identical across 3 runs); trigger2 (7 slots × 5 pages): nonzero=10 clean=3 efault=22 (identical across 3 runs). Leaked windows contain:
• kernel .rodata format strings: "...e rejected because of the security policy\0\0\0\0QoS AP lacks suffic..." and "%s: ahci_get_err_ccb: ci not 0 (%08x)\n(ap->ap_flags & AP_..." (sys/dev/disk/ahci, sys/netproto/802_11);
• raw kernel .text — x86-64 code with rip-relative addressing and kernel link-address immediates (e.g. 48 8b 25 8a 9f 20 00, 8b 2d 6d 9a 20 00, e8 .. .. .. .. call sequences);
• other files' cached pages (e.g. /usr/sbin/ngctl help/string tables: "Aliases:", "Summary:", "Rec'd data packet on..."). These page images come from buffer-cache slots adjacent to the trigger buffer — kernel-image file pages and unrelated files' data. EFAULT returns at valid offsets are themselves impossible on a clean fs and prove the OOB source fault.
• Crafted fs, life 2 (fresh vm.sh reset with-src): baseline re-confirmed (SCAN nonzero=7 clean=3 efault=25) before building the fixed kernel.
• No panic, guest stayed up throughout (dmesg tail clean).

Why this is a distinct finding (not DF-0903 / DF-3190 / DF-2920)

• DF-0903 (write side): its verified verdict shows ffs_write's negative xfersize is clamped and then intercepted by panic("ffs_balloc: blk too big") (ffs_balloc.c:91) — net effect panic/DoS. DF-0903's pack never analyzed the read path; its title even (incorrectly) calls ffs_read's guard a working check. This finding is the read-side leak primitive: no balloc intercept, the OOB copy runs directly inside uiomovebp at ufs_readwrite.c:155.
• DF-3190 (balloc undersize via qfmask + blkfree panic): different sink (ffs_balloc.c:194, ffs_blkfree_cg:1504). Same class of root cause (unvalidated superblock geometry) — DF-3190's mount-time validation fix closes this bug too, which strengthens the case for it; the in-file guard in fix.diff is the defense-in-depth that protects even if a geometry field slips validation.
• DF-2920 (beyond-EOF VM pages): different mechanism entirely.

Impact

Unprivileged local user → disclosure of kernel buffer-cache contents: whatever pages occupy adjacent buffer slots — kernel-image pages (.text/.rodata, useful for defeating any future KASLR-ish mitigation), and cached pages of other users' files (any file recently read by anyone, including root-only files read by root daemons/admin). Also a trivial local DoS flavor (xfersize == 0 sub-case → panic("ufs_readwrite: impossible xfersize") when blkoffset == b_bufsize exactly, e.g. clustered buffers). Precondition: a crafted FFS image must be mounted (root action, or vfs.usermount=1) — identical to DF-0894/DF-0903/DF-3190 preconditions. No route to uid=0 from this primitive alone (read-only disclosure), so the escalation objective is documented as not-applicable for this class; the KVA-disclosure primitive itself is fully characterized above.

Fix validation (kernel #1, built in-guest from patched /usr/src)

• make nativekernel && make installkernel && reboot (fix_build.log, 17087 lines, zero errors, "Kernel install completed").
• Crafted fs + fixed kernel: every invalid-geometry pread → -1 EIO (14 of 15 in trigger, 35/35 in trigger2 — SCAN nonzero=0 clean=0 efault=0 LEAK=0); the one offset whose true blkoffset (0x123) is legitimate (k=8, 0x80123 & 0x7ffff = 0x123) still returns its 512 zero bytes — the guard is surgical, not a blanket failure.
• Clean fs + fixed kernel: SUMMARY nonzero=0 clean=15 efault=0 — behavior identical to stock; no false positives.
• No panic, no leak, guest healthy after all runs.

fix.diff: rejects blkoffset >= bp->b_bufsize with EIO in ffs_read (bp is released by the existing error path at :186-194). Recommended complement: adopt DF-3190's mount-time geometry validation so the whole mask family dies at mount.

Artifacts

README.md (reproduce), craft_img.c, trigger.c, trigger2.c, setup.sh, run.sh, build.sh, run.control_and_trig1.log (stock: control + trigger1), run2.trigger2.log (stock: trigger2 full hexdumps), fix_build.log, fix_patched_mount.log / fix_patched_run.log (fixed kernel runs), env.txt, fix.diff, manifest.json, verdict.json.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.