DF-5779 — seq_puts() shim passes its data string as the kernel printf FORMAT

What / where

• Shim unit under audit: sys/dev/drm/linux_printf.c (seq_printf; known finding DF-2224 covers its va_list forwarding and is NOT re-reported).
• The remaining shim in the same unit, declared in sys/dev/drm/include/linux/seq_file.h:44:

#define seq_puts(m, str)    ksnprintf((m)->buf, (m)->size, str)

str — which the Linux seq_puts() API defines as pure DATA (never interpreted) — sits in ksnprintf's __printflike(3,4) format parameter.

Build

On the host, from this directory:

../../../dfbsd-qemu/vm.sh up          # if down
./build.sh                           # transfers sources (base64 via run_root),
                                     # builds seqputs_rig.ko + seqputs_rigc.ko in-guest

Manual equivalent (in guest /tmp/rig): make SYSDIR=/usr/src/sys WERROR="" with KMOD=seqputs_rig SRCS=seqputs_rig.c (DragonFly bsd.kmod.mk).

Run

./run.sh

1. kldload /tmp/rig/seqputs_rig.ko — rigs A+B (safe): * A: controlled %n → seqputs_rig A: %n wrote 2 (write conversion LIVE) * B: seq_puts(&m, "conn=DP-1 link=%d ok=100%%\n") → link=0 — %d interpreted against a NEVER-passed vararg
2. kldload /tmp/rig/seqputs_rigc.ko — rig C: same macro, data with nine %s → kernel panic (wild strlen), see panic.txt.

Expected output (baseline, vulnerable shim)

seqputs_rig: loaded
seqputs_rig A: %n wrote 2 (2 == LIVE write conv)
seqputs_rig B: seq_puts(m,data) produced: 'conn=DP-1 link=0 ok=100%
'
seqputs_rig B: Linux contract would print the literal data string verbatim (no interpretation)
seqputs_rigc: firing %s-walk on unset varargs...
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x1a640
...
Stopped at      strlen: cmpb $0,(%rdi)

Fix validation

seqputs_rigfix.c compiles the FIXED shim (ksnprintf(buf, size, "%s", str)) and replays the same inputs:

rigfix B: 'conn=DP-1 link=%d ok=100%%
'                      <- verbatim, no interpretation
rigfix C: 'm=%s s=%s x=%s y=%s z=%s w=%s v=%s u=%s t=%s
'                      <- the string that PANICKED baseline: now verbatim
rigfix N: 'w=%d write=%n addr=%p
'                      <- %n/%d/%p in data stay literal
rigfix: DONE verbatim, guest alive

Reachability (honest scope)

In-tree TODAY: every seq_puts/seq_printf call site is a debugfs show callback, and DragonFly defines neither CONFIG_DEBUG_FS nor any debugfs dispatch (sys/dev/drm/drm_internal.h:139-143 stub; drm_debugfs.c not in sys/conf/files; no struct seq_file instantiation exists anywhere). All in-tree seq_puts arguments are %-free literals. The bug is therefore LATENT: it converts any future ported caller that passes a dynamic string (upstream Linux drivers routinely pass EDID/connector-derived names — attacker-influenced bytes from a malicious monitor) into a kernel format-string primitive: %n = write-through-pointer (live, subr_prf.c:688), %s = wild read (panic, proven), %d/%x/%p = kernel slot leak into the seq buffer.

Severity Low (latent hardening / contract divergence). Proof is nonetheless complete: disassembly of the shipped drm.ko (disasm.txt) + live-kernel differential (run.log, run_c.log, panic.txt, fix_run.log).

DF-5779 VERDICT — reproduced (latent primitive, proven live)

Finding

seq_puts() in the DRM Linux-compat shim passes its DATA argument through ksnprintf's FORMAT parameter:

• sys/dev/drm/include/linux/seq_file.h:44 #define seq_puts(m, str) ksnprintf((m)->buf, (m)->size, str)
• Sole in-tree route for a runtime string into that slot: sys/dev/drm/drm_print.c:125-133 (__drm_puts_seq_file), selected via drm_seq_file_printer().puts (sys/dev/drm/include/drm/drm_print.h:184-190) and fed by drm_puts() (sys/dev/drm/drm_print.c:163-169).

Linux's seq_puts(m, s) never interprets s. DragonFly's kernel printf core, however, supports conversions that make a data-as-format bug a memory corruption primitive:

• %n — live write-through-pointer: sys/kern/subr_prf.c:688-701
• %s — unbounded strlen on the va_arg pointer: sys/kern/subr_prf.c:750-755

Verification (guest DragonFly 6.5-DEVELOPMENT, X86_64_GENERIC)

Guest /usr/src md5-verified identical to the audited tree for both linux_printf.c and include/linux/seq_file.h.

1. Disassembly (shipped /boot/kernel/drm.ko) — __drm_puts_seq_file: mov %rsi,%rdx places the caller's str in %rdx, the third parameter of ksnprintf(rdi=buf, rsi=size, rdx=fmt, ...) (disasm.txt). Contract divergence proven at machine-code level in the artifact users boot.

2. Differential rig (live kernel) — seqputs_rig.c replicates the struct + macro verbatim: * Rig A: ksnprintf(buf, size, "AA%nBB\n", &written) → seqputs_rig A: %n wrote 2 — the %n write conversion is live in the running kernel. * Rig B: seq_puts(&m, "conn=DP-1 link=%d ok=100%%\n") (no format args — the seq_puts contract) → output conn=DP-1 link=0 ok=100%: the %d consumed a never-passed vararg slot and its value landed in the seq buffer. Under the Linux contract this string must print verbatim.

3. Rig C (impact ceiling) — same macro, data containing nine %s: Fatal trap 12: page fault while in kernel mode, fault virtual address 0x1a640 … Stopped at strlen: cmpb $0,(%rdi) (panic.txt). Wild kernel read from an unset vararg slot; guest down (reset afterwards).

Fix validation

seqputs_rigfix.c compiles the fixed shim (ksnprintf(buf, size, "%s", str), fix.diff) and replays the same inputs: rig B verbatim, the rig-C panic string verbatim, %d/%n/%p inside data literal, guest alive, module unloaded cleanly (fix_run.log). The fix is a header macro; semantic validation via a consumer compiled against the exact fixed macro is equivalent to a full drm.ko rebuild for this contract (a full rebuild would recompile the identical expansion in every consumer).

baseline: interpretation + leak + panic. patched: verbatim, no panic. => fixed.

Honest reachability scope (why Low, not High)

• CONFIG_DEBUG_FS is not defined anywhere in the DragonFly DRM build (sys/dev/drm/kconfig.h — no match, verified in tree and in guest /usr/src).
• drm_debugfs.c / amdgpu_debugfs.c are not in sys/conf/files; drm_debugfs_init is the no-op inline (sys/dev/drm/drm_internal.h:139-143).
• No struct seq_file is ever instantiated in the tree (grep for allocation: zero hits) — m->buf/m->size never get set by anything.
• Every in-tree seq_printf/seq_puts format/argument today is a %-free or arg-matched literal (scanned all call sites; the only non-literal seq_puts argument is drm_print.c:128 itself).

So no in-tree caller currently executes the primitive: the defect is a latent format-string trap for ported code. Upstream Linux drivers pass dynamic strings to seq_puts (device/connector names, EDID-derived strings — bytes an attacker with a crafted monitor controls), and this shim silently turns that pattern into kernel %n/%s interpretation. The adjacent seq_printf va_list ABI issue is DF-2224 (known; not re-reported).

Files

• disasm.txt — shipped drm.ko disassembly (the %rdx proof)
• run.log — rigs A+B output (live %n, %d slot leak)
• run_c.log + panic.txt — rig C kernel panic
• fix_run.log — fixed-shim replay (verbatim, alive)
• build.log — full untrimmed guest builds (includes the honest first empty-module transfer failure)
• env.txt — guest uname/toolchain/module state

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.