Re: kern/60803: LFS can write uninitialized kernel memory to disk

[Konrad Schroder <perseant%hhhh.org@localhost>]

I was able to reproduce using a slight modification of your script 
(below) and narrowed this down to uninitialized data in inode blocks.  
The following patch (also attached) fixes the issue for me, please let 
me know if it does for you also:

Index: sys/ufs/lfs/lfs_segment.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/lfs/lfs_segment.c,v
retrieving revision 1.316
diff -u -r1.316 lfs_segment.c
--- sys/ufs/lfs/lfs_segment.c   26 Sep 2026 04:32:00 -0000 1.316
+++ sys/ufs/lfs/lfs_segment.c   27 Sep 2026 00:43:36 -0000
@@ -1095,13 +1095,7 @@
                gotblk++;

                /* Zero out inode numbers */
-               for (i = 0; i < LFS_INOPB(fs); ++i) {
-                       union lfs_dinode *tmpdi;
-
-                       tmpdi = (union lfs_dinode *)((char 
*)sp->ibp->b_data +
- DINOSIZE(fs) * i);
-                       lfs_dino_setinumber(fs, tmpdi, 0);
-               }
+               memset(sp->ibp->b_data, 0, lfs_sb_getibsize(fs));

                ++sp->start_bpp;
                lfs_sb_subavail(fs, lfs_btofsb(fs, lfs_sb_getibsize(fs)));

The script I used to test:

-------- 8< --------
#!/bin/sh
#
# Test kernel memory data leakage reported in PR 60803.
#
DISK=/dev/vnd0a
RDISK=/dev/rvnd0a
WD=`pwd`
POWER=32

#
# Prepare small image
#
IMG=60803.img
dd if=/dev/zero of=$IMG bs=1048576 count=32
vnconfig -c vnd0 $IMG
EDITOR=ed disklabel -e vnd0 <<EOF
/ a
s/4.2BSD/4.4LFS/
p
w
EOF

# Exit with a reason
die() {
        echo $*
        exit 1
}

#
# Try to fill up memory with a pattern of something not zero.
# We double the file size till we get to 2^32 bytes, and assume
# that will be good enough.  If you have lots of RAM increase POWER.
#
echo -n 'X' > X.txt
I=0
while [ $I -lt $POWER ]
do
        cat X.txt X.txt > Y.txt
        mv Y.txt X.txt
        I=$(( $I + 1 ))
done
du -h X.txt
rm -f X.txt Y.txt

mkdir -p $WD/testlfs

newfs_lfs -f4k -b32k $RDISK || die newfs_lfs failed
mount_lfs -n $DISK $WD/testlfs || die mount_lfs failed
cd $WD/testlfs
dd if=/dev/zero of=testfile.bin bs=4k count=1
sync
rm testfile.bin
cd ..
umount $WD/testlfs || die umount failed
fsck_lfs -nf $RDISK || die fsck_lfs showed errors

hexdump -C $RDISK > $WD/testlfs.hexdump.txt
vnconfig -u vnd0

# Look for the string we loaded into memory
# in the disk image, and tell us where it is.
# Our filesystem had 4k fragments, so we can
# just drop the last three hex digits to
# locate that sector in dumplfs output.
grep XXXX $WD/testlfs.hexdump.txt | head
-------- 8< --------

Thanks!

--
Konrad Schroder
perseant%hhhh.org@localhost

Index: sys/ufs/lfs/lfs_segment.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/lfs/lfs_segment.c,v
retrieving revision 1.316
diff -u -r1.316 lfs_segment.c
--- sys/ufs/lfs/lfs_segment.c	26 Sep 2026 04:32:00 -0000	1.316
+++ sys/ufs/lfs/lfs_segment.c	27 Sep 2026 00:44:46 -0000
@@ -1095,13 +1095,7 @@
 		gotblk++;
 
 		/* Zero out inode numbers */
-		for (i = 0; i < LFS_INOPB(fs); ++i) {
-			union lfs_dinode *tmpdi;
-
-			tmpdi = (union lfs_dinode *)((char *)sp->ibp->b_data +
-						     DINOSIZE(fs) * i);
-			lfs_dino_setinumber(fs, tmpdi, 0);
-		}
+		memset(sp->ibp->b_data, 0, lfs_sb_getibsize(fs));
 
 		++sp->start_bpp;
 		lfs_sb_subavail(fs, lfs_btofsb(fs, lfs_sb_getibsize(fs)));