Re: kern/60803: LFS can write uninitialized kernel memory to disk

["Konrad Schroder via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/60803; it has been noted by GNATS.

From: Konrad Schroder <perseant%hhhh.org@localhost>
To: gnats-bugs%netbsd.org@localhost, kern-bug-people%netbsd.org@localhost,
 gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/60803: LFS can write uninitialized kernel memory to disk
Date: Sat, 26 Sep 2026 17:54:57 -0700

 This is a multi-part message in MIME format.
 --------------PibeeSJb1L8j2veERRlaoIxA
 Content-Type: text/plain; charset=UTF-8; format=flowed
 Content-Transfer-Encoding: 8bit
 
 I was able to reproduce using a slight modification of your script 
 (below) and narrowed this down to uninitialized data in inode blocks.  
 The following patch (also attached) fixes the issue for me, please let 
 me know if it does for you also:
 
 Index: sys/ufs/lfs/lfs_segment.c
 ===================================================================
 RCS file: /cvsroot/src/sys/ufs/lfs/lfs_segment.c,v
 retrieving revision 1.316
 diff -u -r1.316 lfs_segment.c
 --- sys/ufs/lfs/lfs_segment.c   26 Sep 2026 04:32:00 -0000 1.316
 +++ sys/ufs/lfs/lfs_segment.c   27 Sep 2026 00:43:36 -0000
 @@ -1095,13 +1095,7 @@
  Â  Â  Â  Â  Â  Â  Â  Â  gotblk++;
 
  Â  Â  Â  Â  Â  Â  Â  Â  /* Zero out inode numbers */
 -Â  Â  Â  Â  Â  Â  Â  Â for (i = 0; i < LFS_INOPB(fs); ++i) {
 -Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â union lfs_dinode *tmpdi;
 -
 -Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â tmpdi = (union lfs_dinode *)((char 
 *)sp->ibp->b_data +
 - DINOSIZE(fs) * i);
 -Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â lfs_dino_setinumber(fs, tmpdi, 0);
 -Â  Â  Â  Â  Â  Â  Â  Â }
 +Â  Â  Â  Â  Â  Â  Â  Â memset(sp->ibp->b_data, 0, lfs_sb_getibsize(fs));
 
  Â  Â  Â  Â  Â  Â  Â  Â  ++sp->start_bpp;
  Â  Â  Â  Â  Â  Â  Â  Â  lfs_sb_subavail(fs, lfs_btofsb(fs, lfs_sb_getibsize(fs)));
 
 The script I used to test:
 
 -------- 8< --------
 #!/bin/sh
 #
 # Test kernel memory data leakage reported in PR 60803.
 #
 DISK=/dev/vnd0a
 RDISK=/dev/rvnd0a
 WD=`pwd`
 POWER=32
 
 #
 # Prepare small image
 #
 IMG=60803.img
 dd if=/dev/zero of=$IMG bs=1048576 count=32
 vnconfig -c vnd0 $IMG
 EDITOR=ed disklabel -e vnd0 <<EOF
 / a
 s/4.2BSD/4.4LFS/
 p
 w
 EOF
 
 # Exit with a reason
 die() {
  Â  Â  Â  Â  echo $*
  Â  Â  Â  Â  exit 1
 }
 
 #
 # Try to fill up memory with a pattern of something not zero.
 # We double the file size till we get to 2^32 bytes, and assume
 # that will be good enough.  If you have lots of RAM increase POWER.
 #
 echo -n 'X' > X.txt
 I=0
 while [ $I -lt $POWER ]
 do
  Â  Â  Â  Â  cat X.txt X.txt > Y.txt
  Â  Â  Â  Â  mv Y.txt X.txt
  Â  Â  Â  Â  I=$(( $I + 1 ))
 done
 du -h X.txt
 rm -f X.txt Y.txt
 
 mkdir -p $WD/testlfs
 
 newfs_lfs -f4k -b32k $RDISK || die newfs_lfs failed
 mount_lfs -n $DISK $WD/testlfs || die mount_lfs failed
 cd $WD/testlfs
 dd if=/dev/zero of=testfile.bin bs=4k count=1
 sync
 rm testfile.bin
 cd ..
 umount $WD/testlfs || die umount failed
 fsck_lfs -nf $RDISK || die fsck_lfs showed errors
 
 hexdump -C $RDISK > $WD/testlfs.hexdump.txt
 vnconfig -u vnd0
 
 # Look for the string we loaded into memory
 # in the disk image, and tell us where it is.
 # Our filesystem had 4k fragments, so we can
 # just drop the last three hex digits to
 # locate that sector in dumplfs output.
 grep XXXX $WD/testlfs.hexdump.txt | head
 -------- 8< --------
 
 Thanks!
 
 --
 Konrad Schroder
 perseant%hhhh.org@localhost
 
 --------------PibeeSJb1L8j2veERRlaoIxA
 Content-Type: text/plain; charset=UTF-8; name="60803.diff"
 Content-Disposition: attachment; filename="60803.diff"
 Content-Transfer-Encoding: base64
 
 SW5kZXg6IHN5cy91ZnMvbGZzL2xmc19zZWdtZW50LmMKPT09PT09PT09PT09PT09PT09PT09
 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQpSQ1MgZmls
 ZTogL2N2c3Jvb3Qvc3JjL3N5cy91ZnMvbGZzL2xmc19zZWdtZW50LmMsdgpyZXRyaWV2aW5n
 IHJldmlzaW9uIDEuMzE2CmRpZmYgLXUgLXIxLjMxNiBsZnNfc2VnbWVudC5jCi0tLSBzeXMv
 dWZzL2xmcy9sZnNfc2VnbWVudC5jCTI2IFNlcCAyMDI2IDA0OjMyOjAwIC0wMDAwCTEuMzE2
 CisrKyBzeXMvdWZzL2xmcy9sZnNfc2VnbWVudC5jCTI3IFNlcCAyMDI2IDAwOjQ0OjQ2IC0w
 MDAwCkBAIC0xMDk1LDEzICsxMDk1LDcgQEAKIAkJZ290YmxrKys7CiAKIAkJLyogWmVybyBv
 dXQgaW5vZGUgbnVtYmVycyAqLwotCQlmb3IgKGkgPSAwOyBpIDwgTEZTX0lOT1BCKGZzKTsg
 KytpKSB7Ci0JCQl1bmlvbiBsZnNfZGlub2RlICp0bXBkaTsKLQotCQkJdG1wZGkgPSAodW5p
 b24gbGZzX2Rpbm9kZSAqKSgoY2hhciAqKXNwLT5pYnAtPmJfZGF0YSArCi0JCQkJCQkgICAg
 IERJTk9TSVpFKGZzKSAqIGkpOwotCQkJbGZzX2Rpbm9fc2V0aW51bWJlcihmcywgdG1wZGks
 IDApOwotCQl9CisJCW1lbXNldChzcC0+aWJwLT5iX2RhdGEsIDAsIGxmc19zYl9nZXRpYnNp
 emUoZnMpKTsKIAogCQkrK3NwLT5zdGFydF9icHA7CiAJCWxmc19zYl9zdWJhdmFpbChmcywg
 bGZzX2J0b2ZzYihmcywgbGZzX3NiX2dldGlic2l6ZShmcykpKTsK
 
 --------------PibeeSJb1L8j2veERRlaoIxA--