DF-5151 — dm pdev dedup key silently truncated to 31 chars → wrong-device table binding

• File audited (pass 2): sys/dev/disk/dm/linear/dm_target_linear.c (root cause in sys/dev/disk/dm/dm_pdev.c, reached through the linear target's unvalidated argv[0] device path).
• Severity: Low (privileged local — table loads go through NETBSD_DM_IOCTL on /dev/mapper/control, 0640 root:operator; the group cannot usefully drive it because the pdev vn_open(FREAD|FWRITE) runs under the caller's credentials).
• Verdict: reproduced on the stock 6.5-DEVELOPMENT guest (two independent boots, incl. a fresh vm.sh reset with-src). Fix validated on a rebuilt dm.ko.

Build

./build.sh        # cc -O2 -Wall -o poc_dm_pdev_trunc poc_dm_pdev_trunc.c

(no libprop needed — the plist XML is hand-built; only <sys/ioctl.h>)

Run (as root on the guest)

sh run.sh                       # baseline: kldload dm; kldload dm_target_linear

Setup created by run.sh:

T = /tmp/dmtr/aaaaaaaaaaaaaaaaaaaaa    (exactly 31 chars) -> symlink to /dev/md0   (Y)
L = /tmp/dmtr/aaaaaaaaaaaaaaaaaaaaabb  (33 chars)        -> symlink to /dev/md0s0 (X)

What the PoC does:

1. create dm devices dfa/dfb/dfc
2. reload dfa with linear params "<L> 0" — kernel opens X (md0s0) and stores the pdev under strlcpy(name, L, 32) = T (truncated)
3. reload dfb with linear params "<T> 0" — T resolves to Y (/dev/md0), but dm_pdev_lookup_name(T) strcmp-matches the truncated stored key → dfb silently reuses dfa's pdev without ever opening T
4. control: reload dfc with a nonexistent path → must FAIL (normal behavior)
5. resume dfa/dfb (tables load into the inactive slot), then deps both

Expected output (stock kernel — the bug)

expected deps(dfb) if correct = 0x1e110007     <- dev_t of /dev/md0
reload dfc (...): ioctl FAILED with errno=2    <- control behaves normally
==== RESULT ====
deps(dfa [path L -> /dev/md0s0]) = 0x1e100007  <- md0s0, correct for dfa
deps(dfb [path T -> /dev/md0   ]) = 0x1e100007  <- WRONG: dfb got md0s0's pdev!
MISDIRECTION PROVEN (BUG PRESENT): ...
poc exit=0

/dev/md0 is 0x1e110007, /dev/md0s0 is 0x1e100007 (see ls -l in run.log). Every IO issued to dm device dfb lands on /dev/md0s0 even though its table was loaded with a path that resolves to /dev/md0.

Expected output (patched dm.ko — fix validated)

reload dfa (/tmp/dmtr/aaaaaaaaaaaaaaaaaaaaabb): ioctl FAILED with errno=2
dfa reload with 33-char path was REJECTED by kernel
deps(dfb [path T -> /dev/md0   ]) = 0x1e110007   <- correct device now
FIX CONFIRMED: long path rejected loudly, short path bound to its own device

Console/dmesg evidence of the loud rejection: dm_pdev_insert: device path too long (max 31): /tmp/dmtr/aaaaaaaaaaaaaaaaaaaaabb

Fix rebuild + run:

cd /usr/src && patch -p1 < /tmp/poc5151/fix.diff
cd /usr/src/sys/dev/disk/dm && make obj && make          # -> dm.ko (-Werror clean)
cd /tmp/poc5151 && DM_KO=/usr/obj/usr/src/sys/dev/disk/dm/dm.ko sh run.sh

Artifacts

• poc_dm_pdev_trunc.c — PoC source (hand-built proplist XML ioctls)
• build.sh, run.sh — exact commands
• run.log — decisive baseline run (dirty-boot guest)
• run.2.log — baseline run on a FRESH vm.sh reset with-src boot (deterministic)
• fix.diff — git-apply-able fix (bounds check in dm_pdev_insert)
• fix_build.log, fix_run.log — patched-module build + verification run
• env.txt — guest uname + device list

DF-5151 VERDICT — dm_pdev dedup key truncation → wrong-device table binding

Status: reproduced (deterministic, two boots). Fix validated on rebuilt dm.ko. Impact: silent cross-device data misdirection for dm-linear (and any target that passes device paths to dm_pdev_insert). No memory corruption.

Root cause (line-accurate)

• sys/dev/disk/dm/dm.h:62 — #define DM_MAX_DEV_NAME 32; the pdev is keyed by char name[DM_MAX_DEV_NAME] (sys/dev/disk/dm/dm.h:114).
• sys/dev/disk/dm/linear/dm_target_linear.c:67 — dm_target_linear_init passes the user-supplied argv[0] (from DM_TABLE_PARAMS, sys/dev/disk/dm/dm_ioctl.c:771-772 — no length validation anywhere on the path; dm_table_init's strsep at dm_ioctl.c:826-830 imposes no bound) into dm_pdev_insert(argv[0]).
• sys/dev/disk/dm/dm_pdev.c:203-204 — dm_pdev_alloc does strlcpy(dmp->name, name, DM_MAX_DEV_NAME): a path longer than 31 chars is silently truncated.
• sys/dev/disk/dm/dm_pdev.c:60-63 + 128-136 — dedup is strcmp of the caller's FULL path against the STORED (possibly truncated) name. Consequences: 1. A later dm_pdev_insert(T) where T equals the 31-char truncated prefix of an earlier long path L strcmp-matches → the new table entry silently reuses L's pdev (L's physical device). vn_open(T) never happens — T doesn't even have to exist. 2. Two distinct long paths sharing a 31-char prefix both miss each other (full ≠ truncated) → duplicate pdev entries under the same truncated key (refcount/vnode churn, unbounded pdev duplication under table reloads).
• sys/dev/disk/dm/dm_target_linear.c:114-116 — strategy then routes every bio for the mis-bound table to tlc->pdev's vnode at tlc->offset: reads/writes land on the wrong physical device.

Reachability: NETBSD_DM_IOCTL on /dev/mapper/control (sys/dev/disk/dm/device-mapper.c:181, 0640 root:operator). ioctls are not flag-gated, but the pdev vn_open(FREAD|FWRITE) in dm_dk_lookup (dm_pdev.c:74-78) runs under the caller's credentials, so an operator-group user cannot open real disk nodes RW — effectively root-only to reach a meaningful device. Severity Low accordingly.

Reproduction (see run.log / run.2.log)

• T = /tmp/dmtr/aaaaaaaaaaaaaaaaaaaaa (31 chars) → symlink → /dev/md0 (0x1e110007)
• L = /tmp/dmtr/aaaaaaaaaaaaaaaaaaaaabb (33 chars) → symlink → /dev/md0s0 (0x1e100007)
• reload dfa with L 0 (linear): stored pdev name := first 31 chars of L == T.
• reload dfb with T 0 (linear): user intends /dev/md0; kernel strcmp-matches the truncated key and hands back dfa's pdev.
• deps: deps(dfa) == deps(dfb) == 0x1e100007 (md0s0) although dfb's path resolves to md0 (0x1e110007). Control reload with a non-colliding nonexistent path fails ENOENT, i.e. the kernel normally rejects unknown paths — the collision is what bypasses the open entirely.
• Deterministic: identical result on a fresh vm.sh reset with-src boot.

Real-world shape: DragonFly-style long device paths (/dev/serno/<long serial>-part*.s1d easily exceed 31 chars) are exactly the class that truncates; any two same-model disks whose serials agree in the first ~20 characters collapse onto one truncated key.

Fix validation (fix.diff, fix_build.log, fix_run.log)

dm_pdev_insert now rejects strlen(dev_name) >= DM_MAX_DEV_NAME with a loud kprintf (dm.ko rebuilt in-dir with -Werror, clean). Re-running the exact PoC against the patched module:

• reload dfa (33-char path) → rejected (ENOENT to userland; console: dm_pdev_insert: device path too long (max 31): /tmp/dmtr/...)
• reload dfb (31-char T) → accepted, deps(dfb) = 0x1e110007 = /dev/md0 — the correct device.
• No misdirection possible: the truncating insert can no longer happen.

Alternative (bigger) upstream fix: enlarge name[]/key pdevs by dev_t instead of by name string; the bounds check is the minimal safe change and turns silent misconfiguration into a loud failure.

Not-this-bug (checked and killed)

• table/strategy/destroy lifetime: readers hold table_mtx SHARED across the whole dispatch (dm_table.c:65-74, device-mapper.c:408-465); switch/destroy take EXCLUSIVE (dm_table.c:118,136) — no linear UAF window; module unload is refused while tables hold target refs (dm_target.c:181-184).
• dm_target_linear_table NULL-config deref: unreachable — entries only enter a table after init success, and failed loads destroy the partial table (dm_ioctl.c:783-790).
• kmalloc(M_WAITOK)==NULL branch (dm_target_linear.c:70-72) is dead code; the pdev-ref leak it would cause mirrors known DF-4922 (flakey).
• dump-offset div-by-zero when DIOCGPART fails: known DF-2058/DF-2451.
• non-device vnode backing (v_rdev NULL): known DF-2057/DF-2450.
• offset/length bounds + atoi64 wrap (feeds tlc->offset * DEV_BSIZE at dm_target_linear.c:114): known DF-2150, not re-reported.
• upcall: no such member in DragonFly's dm_target_t (dm.h:159-175) — dead NetBSD-ism; nothing to audit.
• dm_table_add_deps return ignored (dm_target_linear.c:77): linear uses exactly one pdev per entry, the -1 duplicate case cannot arise for this target.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.