DF-4848 — feeder_volume.c FXDIV frame-overcount + count underflow (evidence pack)

What this proves

The REAL, UNMODIFIED sys/dev/sound/pcm/feeder_volume.c divides its source feeder's RETURN VALUE with the inexact generated SND_FXDIV (feeder_volume.c:277). The return value is user-paced (it is the amount of data actually flowing — feed_root returns min(count, sndbuf_getready), and ready is exactly what the unprivileged user write()s). For bad- residue returns inside the claimed [1,65536] domain (first bad: 32768 for align 6, 16384 for align 10, 8195 for 12, 5473 for 14), FXDIV returns floor+1 frames, so:

• T1 apply() reads AND writes a frame past the fed data — past the destination window when the return fills the window (ret == count).
• T2 j*align > count ⇒ count -= j at :286 underflows to ~4GiB ⇒ the loop re-arms and asks the source for a wild window at dst+overrun; with more data ready (user wrote more), the source writes up to bufsoft-ready bytes PAST the window end — a directed heap overflow with user-controlled audio bytes.

feeder_volume is inserted by default for every vchan child (feeder_chain.c:713-716, SD_F_VPC with snd_maxautovchans=16 default).

Build / run (guest)

cd /root/fx && sh build.sh && ./ffvol    # baseline: FAIL (2810/21604)
cp snd_fxdiv_gen_fixed.h snd_fxdiv_gen.h && cc -O1 -g -o ffvol_fixed ffvol.c fxsrc.c
./ffvol_fixed                            # ALL PASS

Expected output

vol.log: ffvol: checks=21604 failures=2810 -> FAIL, decisive lines: FAIL[T1 write] ch=3 align=6 count=32771 ret=32772 REAR guard (write past window) maxoff=32772 — the 3-channel (align 6) case at the first bad residue region.

Fix

fix.diff (shared generator fix). A/B: baseline 2810 failures → fixed 0.

DF-4848 — VERDICT

status: reproduced (feeder level, real unmodified code on the audit guest) primitive: OOB read+write of up to align−1 bytes past the destination window; then count underflow to ~4GiB and a wild second-pass source fill that can write up to bufsoft-ready (tens of KB) of user-controlled bytes past the window end confidence: certain (harness-proven on pristine code; underflow re-arm observed directly)

Root cause

feeder_volume.c:277:

j = SND_FXDIV(FEEDER_FEED(f->source, c, dst, count, source), info->align);

The dividend is the SOURCE RETURN — not a kernel-chosen aligned value but the byte count actually delivered, which for the root feeder is min(count, sndbuf_getready(src)) (feeder.c:466) — i.e. exactly what the unprivileged user has write()n into the channel. The generated SND_FXDIV misrounds UP (floor+1) for bad-residue dividends within the claimed domain (first bad x: align 6 → 32768, align 10 → 16384, align 12 → 8195, align 14 → 5473; see DF-4846 for the exhaustive enumeration). Then:

• :282 apply(vol, matrix, ch, dst, j) processes (ret/align + 1) frames — reading and writing one frame past the fed data; when ret == count the extra frame is past the destination window (canary REAR hit at exactly count+1 in the harness).
• :284-286 j *= align; count -= j; with j = ret+delta > count ⇒ count wraps to ~4294967295 ⇒ while (count != 0) re-arms ⇒ FEEDER_FEED(f->source, c, dst+overrun, ~4GiB, ...) — the source (root) then writes min(4GiB, ready) bytes at dst+overrun, i.e. up to the bufsoft-ready amount of user-audio bytes PAST the window end. In-kernel the window is the caller's scratch (to->tmpbuf or the format feeder's in-place tail): a directed heap overflow whose length the attacker paces via write() sizes and whose content is the attacker's audio samples.

Reproduction (guest, pristine file)

ffvol (vol.log): checks=21604 failures=2810, decisive:

FAIL[T1 write] ch=3 align=6 count=32771 ret=32772 REAR guard (write past window) maxoff=32772

T2 (underflow re-arm) is detected via the source-ask audit (wild pointer / maxask > window); the T1 lines above are the direct window overruns.

Kernel reachability

• feeder_volume is inserted for every vchan child by default: feeder_chain.c:713-716 (SD_F_VPC + snd_maxautovchans = 16 default, sound.c:62), and for soft-pcm-volume devices.
• Channel counts 3/5/6/7 (align 6/10/12/14) are unprivileged SNDCTL_DSP_CHANNELS choices (dsp.c clamps ≤ 8 — 3,5,6,7 all legal).
• The dividend is user-paced: write sizes choose ready at feed time.
• The underflow second pass writes past the window into adjacent kernel heap; the harness bounds it to the guarded arena to log instead of corrupting the guest process.

In-kernel churn (bad-residue pacing on 6ch/7ch vchans, ES1370): no differential anomaly vs aligned control on this no-INVARIANTS kernel (logs in the DF-4849 pack) — consistent with DF-4710's experience; the primitive's observability requires a detector (INVARIANTS/KASAN) the production guest lacks.

Fix validation

fix.diff (generator): baseline 2810 failures → fixed 0 (ALL PASS) (vol.log vs vol_fixed.log). fix_status: fixed.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.