/* * DF-0884 - Use-after-free in smbfs_readvdir via dead-code vnode lock * upgrade on read(2) of a directory. * * This is a DETERMINISTIC HARNESS that transcribes the kernel race from * sys/vfs/smbfs/smbfs_io.c and sys/vfs/smbfs/smbfs_smb.c into userspace. * The live trigger needs a mounted SMB share (an SMB server reachable from * the kernel client), which is not present on this isolated KVM guest - * there is no network beyond QEMU user-mode NAT to the host and no SMB * server. Per the harness precedent (DF-0598 / DF-0599, also smbfs), we * prove the bug deterministically by transcribing the exact code path and * racing the two threads across a controllable interleaving point that * models the SMB network round-trip inside smbfs_findnext(). * * --------------------------------------------------------------------------- * The bug (every hop cited against sys/vfs/smbfs/smbfs_io.c): * * vfs_vnops.c:751 vn_read() does vn_lock(vp, LK_SHARED | LK_RETRY) * so the directory vnode is held SHARED on read(2). * smbfs_io.c:202 lks = LK_EXCLUSIVE; with the lockstatus() call that * would detect the real shared mode COMMENTED OUT; lks * is hardcoded to LK_EXCLUSIVE. * smbfs_io.c:203 if (lks == LK_SHARED) -- ALWAYS FALSE (dead code) * smbfs_io.c:204 vn_lock(vp, LK_UPGRADE ...) -- DEAD CODE * smbfs_io.c:205 error = smbfs_readvdir(vp, ...) -- runs SHARED * * smbfs_readvdir() (smbfs_io.c:78-174) MUTATES per-vnode directory * iteration state: np->n_dirseq and np->n_dirofs (lines 118-141). The * dead-code upgrade means two read(2) callers can run smbfs_readvdir() * CONCURRENTLY under the shared lock. * * The race to UAF: * Thread A: smbfs_readvdir -> smbfs_findnext(ctx, ...) (smbfs_io.c:137 * or :151). smbfs_findnext() (smbfs_smb.c:1196) blocks on a * full SMB network round-trip inside smbfs_findnextLM1/LM2 * (smbfs_smb.c:854/1049) while still holding the ctx pointer * (== the pointer stored in np->n_dirseq). * Thread B: smbfs_readvdir, offset != np->n_dirofs (A advanced it), so * takes the REOPEN branch (smbfs_io.c:118-135) and calls * smbfs_findclose(np->n_dirseq, ...) at smbfs_io.c:121. * smbfs_findclose() (smbfs_smb.c:1224-1236) does * kfree(ctx, M_SMBFSDATA) at smbfs_smb.c:1234. * Thread A: resumes from the blocked smbfs_findnext() and WRITES * ctx->f_attr.fa_ino at smbfs_smb.c:1220 (and reads it back * at smbfs_io.c:157) -> WRITE/READ UAF on freed smbfs_fctx. * * The getdents(2) path is NOT affected: smbfs_readdir() unconditionally * takes LK_EXCLUSIVE (smbfs_vnops.c:725). * * --------------------------------------------------------------------------- * Harness model: * - The vnode lock is a pthread rwlock; LK_SHARED == read-lock, * LK_EXCLUSIVE == write-lock, LK_UPGRADE == upgrade (write-lock). * - The "SMB network round-trip" inside smbfs_findnext is a controllable * barrier: Thread A blocks on a pthread cond var; the test thread * releases it ONLY AFTER Thread B has run smbfs_findclose() on A ctx, * modelling the full round-trip race window deterministically. * - The allocator is POISONED: every free() overwrites the object with * 0xDD bytes and marks it freed, so a write through the dangling ctx * is detected unambiguously (the poison signature is destroyed / * observed-over-freed). * * Two modes (argv[1]): * "buggy" -- transcribes smbfs_io.c:202-203 as-shipped (dead upgrade). * "fixed" -- transcribes the fix.diff: UNCONDITIONAL LK_UPGRADE before * smbfs_readvdir() and LK_DOWNGRADE after, so the two * readers serialize and the race cannot occur. * * Build: cc -O2 -pthread -o harness harness.c * Run: ./harness buggy (expect: UAF CONFIRMED) * ./harness fixed (expect: FIXED no UAF) */ #include #include #include #include #include #include #include /* ---- poisoned allocator ------------------------------------------------ */ #define POISON_BYTE 0xDD struct alloc_rec { void *ptr; size_t sz; int freed; }; static struct alloc_rec g_allocs[64]; static int g_nallocs = 0; static void * poison_malloc(size_t sz) { void *p = calloc(1, sz ? sz : 1); if (!p) { perror("calloc"); exit(2); } if (g_nallocs < 64) { g_allocs[g_nallocs].ptr = p; g_allocs[g_nallocs].sz = sz; g_allocs[g_nallocs].freed = 0; g_nallocs++; } return p; } static void poison_free(void *p) { int i; for (i = 0; i < g_nallocs; i++) { if (g_allocs[i].ptr == p) { if (g_allocs[i].freed) { fprintf(stderr, "[alloc] DOUBLE FREE detected on %p\n", p); exit(3); } /* model kfree(): don't actually return the page to the pool * yet; poison it so a write through the dangling pointer is * observable. */ memset(p, POISON_BYTE, g_allocs[i].sz); g_allocs[i].freed = 1; return; } } fprintf(stderr, "[alloc] free of untracked %p\n", p); exit(4); } static int poison_is_freed(void *p) { int i; for (i = 0; i < g_nallocs; i++) if (g_allocs[i].ptr == p) return g_allocs[i].freed; return -1; } /* ---- transcribed kernel structures (only fields the race touches) ----- */ struct smbfattr { /* smbfs_subr.h:65 */ int fa_attr; int64_t fa_size; long fa_ino; /* fa_mtime etc. elided — irrelevant to the race */ }; struct smbnode { /* smbfs_node.h:69-70 */ struct smbfs_fctx *n_dirseq; /* ff context (the raced pointer) */ long n_dirofs; /* last ff offset */ long n_ino; }; struct smbfs_fctx { /* smbfs_subr.h:90 */ int f_flags; struct smbfattr f_attr; char *f_name; int f_nmlen; long f_dirofs_marker; /* unused in race, kept for size */ /* remaining fields (f_ssp, f_rq, f_t2, f_skey, ...) elided */ }; /* ---- vnode lock model -------------------------------------------------- */ static pthread_rwlock_t g_vnlock; /* models vp->v_lock */ /* ---- network-round-trip interleaving point ----------------------------- */ /* Thread A blocks in smbfs_findnext() on g_netio_cond until the orchestrator * (main) signals it AFTER Thread B has freed A's ctx. This deterministically * models the full SMB network round-trip during which the race window is * open. */ static pthread_mutex_t g_netio_mtx = PTHREAD_MUTEX_INITIALIZER; static pthread_cond_t g_netio_cond = PTHREAD_COND_INITIALIZER; static int g_netio_thread_a_blocked = 0; /* A set then waits */ static int g_netio_release_a = 0; /* orchestrator set */ static volatile int g_b_freed_a_ctx = 0; /* B did findclose */ static int g_a_write_saw_freed = -1; /* A's snapshot at write */ /* ---- transcribed smbfs_smb.c ------------------------------------------- */ static int model_smbfs_findopen(struct smbnode *np, struct smbfs_fctx **ctxpp) { /* smbfs_smb.c:1170 */ struct smbfs_fctx *ctx = poison_malloc(sizeof(*ctx)); /* :1177 */ ctx->f_flags = 0; ctx->f_attr.fa_ino = 0; ctx->f_name = poison_malloc(16); *ctxpp = ctx; (void)np; return 0; } static int model_smbfs_findnext(struct smbfs_fctx *ctx, int limit) { /* smbfs_smb.c:1196 */ /* smbfs_findnextLM1/LM2 perform an SMB network round-trip here * (smbfs_smb.c:868 smbfs_smb_search / :1099 smb_t2_request). The race * window is exactly this blocking I/O. Model it: block on the cond var * the FIRST time (Thread A) so B can run findclose() underneath us. */ (void)limit; pthread_mutex_lock(&g_netio_mtx); if (!g_netio_thread_a_blocked) { /* This is Thread A's call. Announce we are "in" the network I/O * holding ctx (== np->n_dirseq), then block until released. */ g_netio_thread_a_blocked = 1; pthread_cond_signal(&g_netio_cond); /* wake orchestrator */ while (!g_netio_release_a) pthread_cond_wait(&g_netio_cond, &g_netio_mtx); pthread_mutex_unlock(&g_netio_mtx); /* *** RACE WINDOW IS NOW OPEN *** ctx may have been kfree()'d by * Thread B's smbfs_findclose() while we were blocked. Snapshot the * freed state BEFORE the write so the verdict can tell the UAF case * (B freed first) from the safe case (A still owns ctx). Then * resume the transcribed post-I/O write: smbfs_smb.c:1220. */ g_a_write_saw_freed = poison_is_freed(ctx); ctx->f_attr.fa_ino = 0xCAFEBABE; /* THE UAF WRITE */ return 0; } /* Subsequent calls (Thread B) model instant local completion. */ pthread_mutex_unlock(&g_netio_mtx); ctx->f_attr.fa_ino = 0xBEEF; return 0; } static void model_smbfs_findclose(struct smbfs_fctx *ctx) { /* smbfs_smb.c:1224 */ if (ctx->f_name) poison_free(ctx->f_name); /* :1233 (f_rname) */ poison_free(ctx); /* :1234 kfree(ctx) */ } /* ---- transcribed smbfs_io.c smbfs_readvdir (only the raced path) ------ */ struct uio { long uio_offset; long uio_resid; }; static int model_smbfs_readvdir(struct smbnode *np, struct uio *uio) { /* smbfs_io.c:78 */ struct smbfs_fctx *ctx; int error, offset; if (uio->uio_offset < 0) return 1; /* smbfs_io.c:91 EINVAL */ offset = uio->uio_offset; /* :95 */ /* skip the "." / ".." synthesis (lines 97-113): we model offset==0 as * a fresh reader so the reopen branch fires. */ if (offset != np->n_dirofs || np->n_dirseq == NULL) { /* :118 */ if (np->n_dirseq) { /* *** smbfs_io.c:121 *** -- this is the kfree() that races * with another thread's in-flight smbfs_findnext(ctx). */ model_smbfs_findclose(np->n_dirseq); np->n_dirseq = NULL; /* :122 */ } np->n_dirofs = 2; /* :124 */ error = model_smbfs_findopen(np, &ctx); /* :125 */ if (error) return error; np->n_dirseq = ctx; /* :132 */ } else { ctx = np->n_dirseq; /* :134 */ } /* skip-ahead loop (136-144) elided; offset model jumps to inner loop */ /* inner loop (146-168): smbfs_findnext then use ctx->f_attr */ if (uio->uio_resid > 0) { error = model_smbfs_findnext(ctx, 1); /* :151 */ if (error) return error; np->n_dirofs++; /* :154 */ /* smbfs_io.c:157 reads ctx->f_attr.fa_ino back: another UAF read * on the freed ctx. Touch it to make the read observable. */ long ino = ctx->f_attr.fa_ino; /* UAF READ */ (void)ino; } return 0; } /* ---- transcribed smbfs_io.c smbfs_readvnode ---------------------------- */ static int g_fixed_mode = 0; /* 0 = as-shipped (dead upgrade), 1 = fixed */ static int model_smbfs_readvnode(struct smbnode *np, struct uio *uio) { /* smbfs_io.c:176 */ int lks, error; if (uio->uio_resid == 0) return 0; /* :196 */ if (1 /* vp->v_type == VDIR, :201 */) { /* smbfs_io.c:202-204 (AS-SHIPPED -- dead upgrade): */ lks = 2 /* LK_EXCLUSIVE */; /* lockstatus() commented out */ if (lks == 1 /* LK_SHARED */) /* :203 ALWAYS FALSE */ pthread_rwlock_wrlock(&g_vnlock); /* :204 dead */ if (g_fixed_mode) { /* fix.diff: UNCONDITIONAL shared->exclusive upgrade before the * directory iteration that mutates per-vnode state. * * DragonFly lockmgr LK_UPGRADE (kern_lock.c:576) has an explicit * anti-deadlock rule: if another upgrade is already pending, the * caller RELEASES its shared lock and acquires exclusive * normally (kern_lock.c:616-625). pthread rwlocks have no * atomic upgrade and would deadlock if a read-holder calls * wrlock, so we model the upgrade as that same safe sequence: * drop shared, take exclusive. After readvdir we reverse it * (drop exclusive, take shared) so vn_read's caller still * observes a shared hold on return (model of LK_DOWNGRADE). */ pthread_rwlock_unlock(&g_vnlock); /* drop shared */ if (pthread_rwlock_wrlock(&g_vnlock) != 0) { /* take excl */ fprintf(stderr, "FIXED: upgrade failed\n"); return 1; } } error = model_smbfs_readvdir(np, uio); /* :205 */ if (g_fixed_mode) { pthread_rwlock_unlock(&g_vnlock); /* drop excl */ pthread_rwlock_rdlock(&g_vnlock); /* take shared */ } return error; } return 0; } /* ---- vnode lock acquire/release (model of vfs_vnops.c:751) ------------- */ static void vn_read_enter(void) { /* vn_read: LK_SHARED */ pthread_rwlock_rdlock(&g_vnlock); } static void vn_read_leave(void) { pthread_rwlock_unlock(&g_vnlock); } /* ---- worker threads ---------------------------------------------------- */ struct job_arg { struct smbnode *np; long offset; long resid; int rc; }; static void * thread_read(void *v) { struct job_arg *a = v; struct uio uio = { a->offset, a->resid }; vn_read_enter(); /* vfs_vnops.c:751 LK_SHARED */ a->rc = model_smbfs_readvnode(a->np, &uio); vn_read_leave(); return NULL; } int main(int argc, char **argv) { struct smbnode node; pthread_t ta, tb; struct job_arg a_arg = { &node, 0, 64, -1 }; struct job_arg b_arg = { &node, 0, 64, -1 }; if (argc >= 2 && strcmp(argv[1], "fixed") == 0) g_fixed_mode = 1; pthread_rwlock_init(&g_vnlock, NULL); memset(&node, 0, sizeof(node)); node.n_dirseq = NULL; node.n_dirofs = 0; node.n_ino = 2; printf("[*] DF-0884 harness: mode=%s\n", g_fixed_mode ? "FIXED" : "BUGGY"); printf("[*] Thread A: read(2) on VDIR at offset 0 (will block in smbfs_findnext)\n"); printf("[*] Thread B: read(2) on VDIR at offset 0 (will reopen -> findclose A's ctx)\n"); /* Start Thread A; it will enter smbfs_findnext, announce it is blocked, * and wait for the orchestrator release. */ pthread_create(&ta, NULL, thread_read, &a_arg); /* Wait until Thread A is blocked "in network I/O" holding ctx. */ pthread_mutex_lock(&g_netio_mtx); while (!g_netio_thread_a_blocked) pthread_cond_wait(&g_netio_cond, &g_netio_mtx); pthread_mutex_unlock(&g_netio_mtx); printf("[*] Thread A is now blocked inside smbfs_findnext() holding ctx (== n_dirseq)\n"); printf("[*] n_dirseq=%p n_dirofs=%ld\n", (void*)node.n_dirseq, node.n_dirofs); /* Snapshot the ctx pointer Thread A is using. */ struct smbfs_fctx *a_ctx = node.n_dirseq; /* Start Thread B. In BUGGY mode B's read holds the lock SHARED (A does * too, because the upgrade is dead code), so B enters smbfs_readvdir * concurrently, takes the REOPEN branch (B offset 0 != n_dirofs 2), and * calls smbfs_findclose(n_dirseq = A's ctx) -> kfree(A's ctx). In FIXED * mode B blocks on the write-lock upgrade until A is done. */ pthread_create(&tb, NULL, thread_read, &b_arg); if (!g_fixed_mode) { /* Give B time to run findclose() on A's ctx. B will complete its * readvdir and release the shared lock. */ usleep(100 * 1000); int fr = poison_is_freed(a_ctx); printf("[*] After Thread B ran: A's ctx=%p freed? %s (poison=0x%02X)\n", (void*)a_ctx, fr == 1 ? "YES" : (fr == 0 ? "no" : "?"), POISON_BYTE); if (fr != 1) { printf("[!] UNEXPECTED: B did not free A's ctx; harness mis-modelled\n"); pthread_mutex_lock(&g_netio_mtx); g_netio_release_a = 1; pthread_cond_broadcast(&g_netio_cond); pthread_mutex_unlock(&g_netio_mtx); pthread_join(ta, NULL); pthread_join(tb, NULL); return 5; } printf("[*] Releasing Thread A from smbfs_findnext() -- it will now write ctx->f_attr.fa_ino THROUGH FREED MEMORY\n"); } else { printf("[*] FIXED mode: Thread B is blocked on the exclusive upgrade " "(A still holds shared); A must finish readvdir first.\n"); printf("[*] Releasing Thread A so it can complete smbfs_readvdir() " "and only THEN drop the shared lock for B.\n"); } /* Release Thread A. In BUGGY mode: A resumes its post-I/O write through * the already-freed ctx (UAF). In FIXED mode: A completes readvdir * normally and releases the shared lock, after which B's upgrade wins * and B runs readvdir on its own ctx (no race). */ pthread_mutex_lock(&g_netio_mtx); g_netio_release_a = 1; pthread_cond_broadcast(&g_netio_cond); pthread_mutex_unlock(&g_netio_mtx); pthread_join(ta, NULL); pthread_join(tb, NULL); printf("[*] Thread A rc=%d Thread B rc=%d\n", a_arg.rc, b_arg.rc); /* ---- verdict ------------------------------------------------------- */ if (!g_fixed_mode) { /* g_a_write_saw_freed captures whether A's ctx was already freed at * the instant A resumed and wrote fa_ino. In buggy mode B's * findclose() ran while A was blocked, so it is 1 (freed) -> UAF. */ if (g_a_write_saw_freed == 1) { printf("[+] A wrote ctx->f_attr.fa_ino (0x%lx) into an object " "that was ALREADY freed by Thread B's smbfs_findclose()\n", (unsigned long)a_ctx->f_attr.fa_ino); printf(">>> UAF CONFIRMED: smbfs_findnext wrote through freed " "smbfs_fctx (dead-code lock upgrade lets two read(2) on a " "VDIR run smbfs_readvdir concurrently)\n"); return 0; } printf("[!] UAF NOT observed (g_a_write_saw_freed=%d, harness error)\n", g_a_write_saw_freed); return 6; } else { /* In fixed mode the upgrade serializes A and B; A completes its full * readvdir (findnext -> dirent) BEFORE B can enter, so B never frees * A's in-flight ctx. g_a_write_saw_freed must be 0 (not freed at * A's write instant). */ if (g_a_write_saw_freed == 0) { printf("[+] FIXED: at A's write instant, ctx was still owned by A " "(g_a_write_saw_freed=0); the exclusive upgrade serialized " "the two readers so B's findclose ran only after A finished\n"); printf(">>> FIXED: no UAF -- unconditional LK_UPGRADE before " "smbfs_readvdir closes the race\n"); return 0; } printf("[!] FIXED mode but A's ctx was freed at write instant " "(g_a_write_saw_freed=%d) -- fix ineffective\n", g_a_write_saw_freed); return 7; } }