DF-3232 — Unvalidated fs_fragshift scales the FFS block-bitmap byte index

up to 8× past the cylinder-group bitmap → OOB read AND single-byte 0x00/0xff OOB write in buffer-cache memory from one unprivileged ftruncate() (sys/vfs/ufs/ffs_subr.c)

What

The block-bitmap helpers in ffs_subr.c index the cylinder-group free-block bitmap (one bit per fragment ⇒ fpg / fs_frag bytes) with a block number derived by shifting a fragment number down by the superblock's fs_fragshift:

/* fs.h:518 */  fragstoblks(fs, frags)  ==  frags >> fs->fs_fragshift
/* ffs_alloc.c:1538 */ blkno = fragstoblks(fs, bno);   /* bno = dtogd(freed blk) */
/* ffs_alloc.c:1539 */ ffs_isfreeblock(fs, blksfree, blkno);   /* OOB READ  */
/* ffs_alloc.c:1544 */ ffs_setblock(fs, blksfree, blkno);      /* OOB WRITE */

ffs_mountfs validates only fs_magic and the fs_bsize range (ffs_vfsops.c:642-646) and ffs_oldfscompat (ffs_vfsops.c:796-818) never touches fs_fragshift, so an image with

fs_frag     = 8      (valid — the switch() in every bitmap helper is happy)
fs_fragshift= 0      (should be 3: log2(fs_frag))
fs_fpg      = 131072 (so dtogd(bno) == bno keeps the forged block in cg0)

mounts cleanly, and every bitmap index becomes 8× too large: with fs_frag == 8 the bitmap holds one byte per 8 frags, but h = bno >> 0 = bno addresses one byte per frag — cp[bno] walks off the end of the bitmap and off the end of the fs_cgsize-byte bread()'d cg buffer.

Sinks in sys/vfs/ufs/ffs_subr.c (all reached from ordinary file operations on the crafted mount):

The freed/allocated block number bno is attacker-chosen (a file's di_db[] on the image), so the OOB offset is attacker-chosen up to fs_fpg bytes past the bitmap start — with fs_fpg = 131072 that is up to ~123 KB past b_data, i.e. across multiple 64-KB buffer-cache KVA slots into other buffers' data. Write value is a full byte: 0xff (setblock), 0x00 (clrblock case 8).

Preconditions

• crafted FFS image (any unprivileged user can prepare it);
• mount by root (vfs.usermount=0 default) — or fully unprivileged with vfs.usermount=1 (same profile as DF-0894/0903/3190/3212);
• trigger is one syscall by any user with write permission on one file.

PoC (verified on the stock INVARIANTS guest, X86_64_GENERIC #0)

sbtool2 builds a stock 128 MB newfs -b 8192 -f 1024 image, creates victim (one 8 K block), then offline patches the superblock (fs_fragshift 3→0, fs_fpg→131072, softdep flag cleared) and points victim's di_db[0] at a chosen fragment BNO. Root mounts; maxx (uid 1001) runs trigger = open()+ftruncate(0)+sync().

Real geometry (dumped by sbtool2 info): cg buffer fs_cgsize = 8192, cg_freeoff = 1628, bitmap = fpg/8 = 5632 bytes, cg0 block at byte 24576.

Control: identical image/trigger with stock fs_fragshift — survives, truncates to 0, clean unmount (run.control.log).

Build / run

# guest, as root:
sh /root/df3232/build.sh          # cc sbtool2.c trigger.c
sh /root/df3232/setup.sh 16000    # build+poison image, mount crafted RW
su -m maxx -c "/tmp/trig3232 /mnt/victim"     # → fatal trap (run 1)
# variants: setup.sh 6000 → panic 'freeing free block'
#           setup.sh pick → auto-picks a zero byte → silent 0xff write

Impact

• attacker-offset single-byte 0x00/0xff write into buffer-cache memory (groomable: with BNO past 64 KB the write crosses into neighbouring buffers' mapped data — same KVA layout DF-3190 documented), and
• attacker-offset OOB read used as a value oracle (freeing free block panic ⇔ byte ≠ 0), and
• two deterministic unprivileged reboot-equivalent panics.

No uid=0 chain was completed: the write value is constrained to one byte (0x00/0xff) and the victim buffer population at the target KVA slot is not steerable enough on this configuration to reach a credential-bearing object reliably — documented as the hard blocker (see VERDICT.md).

Fix

Validate the shift/mask geometry at mount (see fix.diff): reject unless fs_frag ∈ {1,2,4,8}, (1 << fs_fragshift) == fs_frag, fs_bsize == fs_fsize << fs_fragshift, fs_bmask == fs_bsize-1, fs_fmask == fs_fsize-1 and the 64-bit masks are the proper complements. This also closes the mask-craft family (DF-3190/3212/0903) at the same gate.

DF-3232 VERDICT

Status: reproduced (impact: kernel memory corruption — OOB read + single-byte 0x00/0xff OOB write at attacker-chosen offset; demonstrated as two deterministic panics and one on-disk-persisted silent write; unpriv→ uid0 chain NOT completed — blocker documented below).

Root cause (line-accurate)

• sys/vfs/ufs/fs.h:518-521 — fragstoblks(fs,frags) = frags >> fs->fs_fragshift, blkstofrags = blks << fs->fs_fragshift.
• sys/vfs/ufs/ffs_vfsops.c:642-646 — mount validates only fs_magic and fs_bsize ∈ [sizeof(struct fs), MAXBSIZE]. fs_fragshift is never validated or re-derived (ffs_oldfscompat at :796-818 only touches qbmask/qfmask for fs_inodefmt < FS_44INODEFMT).
• sys/vfs/ufs/ffs_alloc.c:1538-1544 — free path: blkno = fragstoblks(fs, bno) then ffs_isfreeblock/ffs_setblock with that index; alloc path :1137/:1208-1209 identical with ffs_isblock/ffs_clrblock.
• sys/vfs/ufs/ffs_subr.c:221-307 — the helpers themselves contain no bounds; with fs_frag == 8 the bitmap is fpg/8 bytes and the byte index must be < fpg/8; fs_fragshift = 0 multiplies every index by 8.

fs_frag itself staying valid (8) is what takes this beyond DF-0919: DF-0919's panic/OOB requires fs_frag ∉ {1,2,4,8}; here every switch() is satisfied and the OOB is purely in the index scaling.

How reproduced (stock INVARIANTS guest, X86_64_GENERIC #0, 3 boots)

Crafted image = stock newfs -b 8192 -f 1024 + offline patch (sbtool2): fs_fragshift 3→0, fs_fpg→131072 (keeps the forged block in cg0 through dtogd), FS_DOSOFTDEP cleared (synchronous free), and the victim file's di_db[0] set to the chosen fragment. Root mounts; maxx (uid 1001) runs open+ftruncate(0)+sync:

1. bno=16000 — cp[16000] = b_data+17628 (+9.4 KB past the 8192-byte cg buffer): Fatal trap 12, supervisor read, page not present, Stopped at ffs_isfreeblock+0x19 (ffs_subr.c:250). Fault VA − 0x44DC(=1628+16000) is exactly page-aligned b_data.
2. bno=6000 — byte past the 5632-byte bitmap but inside the mapped buffer (cluster-map region, nonzero): panic: ffs_blkfree: freeing free block — dev=vn0, block=6000 — the OOB read returned live kernel data and the kernel used it as an oracle.
3. bno=5648 — zero byte past the bitmap inside the buffer: trigger survives, clean unmount, and the image byte at cg0+freeoff+5648 (offset 31852) flipped 00 → ff on disk — ffs_setblock's cp[5648] = 0xff (ffs_subr.c:294) executed and persisted.
4. control — identical image/trigger with stock fs_fragshift: survives, truncates, unmounts cleanly.

Primitive & uid0 assessment

• Read: OOB byte at chosen offset (value oracle via panic/no-panic).
• Write: single byte 0x00 (clrblock) / 0xff (setblock) at offset cg_freeoff + bno with bno chosen through the file's block pointer — up to fs_fpg bytes past the bitmap start (demonstrated +9.4 KB; layout allows ≫ 64 KB, crossing into neighbouring buffer KVA slots).
• uid0 chain NOT completed, honestly: (a) the value is constrained to one byte of 0x00/0xff per free; (b) the victim buffer occupying the target KVA slot is not reliably steerable on this guest — the cg buffer itself is transient (bread/bdwrite), so grooming a credential-bearing object into the adjacent 64 KB slot deterministically was not achievable in the attempt budget. The on-disk-persisted write (run 3) proves the write executes at a chosen offset; turning it into uid0 remains open.

Fix

fix.diff — mount-time geometry gate in ffs_mountfs: reject unless fs_frag ∈ {1,2,4,8}, 1<<fs_fragshift == fs_frag, fs_bsize == fs_fsize<<fs_fragshift, bshift/fshift/bmask/fmask consistent, and (modern inodefmt) qbmask/qfmask are the exact complements. Validated: see fix section of verdict.json (patched kernel

1 rejects the crafted image at mount; stock image unaffected).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.