⬢ DragonFlyBSD Kernel Audit
DF-3173 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
{
  "finding_id": "DF-3173",
  "title": "autofs timeout task armed on creator cpu's taskqueue but cancelled/drained on last releaser cpu's queue: foreign-list STAILQ_REMOVE NULL-deref panic + wrong-queue drain UAF (read+write after objcache_put)",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "variant_B": {
    "status": "partially reproduced",
    "note": "cross-cpu frees observed via same-magazine re-get; post-free ar_error/ar_done changes observed on freed objects; the clean e0=0->e1=ETIMEDOUT marker was out-raced by the panic-prone interleaving in the final runs; drain-side defect fully determined by code trace (subr_taskqueue.c:493 compares passed queue's tq_running)"
  },
  "reproduce": {
    "build": "sh findings/poc/DF-3173/build.sh (in-guest: kmod make + cc fake_daemon3173.c + cc pending_stat.c)",
    "run": "sh findings/poc/DF-3173/run.sh",
    "expected": "after 'DF3173: R01 ... ta_pending=1' samples: Fatal trap 12, fault virtual address = 0x0, Stopped at taskqueue_cancel_locked+0x45 (movq (%rcx),%rax); cpuid != home_tq cpu; current process = the releaser stat"
  },
  "fix": {
    "fix_status": "fixed",
    "fix_file": "fix.diff",
    "baseline": "panic in round 1, deterministic (4 reproductions)",
    "patched": "22+ rounds completed, zero traps, guest up, cross-cpu frees still occur and are harmless",
    "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Sep  7 20:24:03 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
  },
  "kernel_refs": [
    "sys/vfs/autofs/autofs.c:303",
    "sys/vfs/autofs/autofs.c:357",
    "sys/vfs/autofs/autofs.c:359",
    "sys/vfs/autofs/autofs.c:324",
    "sys/vfs/autofs/autofs.c:338",
    "sys/vfs/autofs/autofs.c:366",
    "sys/vfs/autofs/autofs.c:395",
    "sys/vfs/autofs/autofs.c:398",
    "sys/vfs/autofs/autofs.c:399",
    "sys/vfs/autofs/autofs.c:400",
    "sys/vfs/autofs/autofs.c:196",
    "sys/vfs/autofs/autofs.c:202",
    "sys/vfs/autofs/autofs.c:506",
    "sys/kern/subr_taskqueue.c:184",
    "sys/kern/subr_taskqueue.c:424",
    "sys/kern/subr_taskqueue.c:469",
    "sys/kern/subr_taskqueue.c:493",
    "sys/kern/subr_taskqueue.c:522",
    "sys/sys/queue.h:319",
    "sys/sys/taskqueue.h:169"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "df3173_race.c",
    "fake_daemon3173.c",
    "pending_stat.c",
    "autofs_ioctl.h",
    "Makefile",
    "build.sh",
    "run.sh",
    "runB.sh",
    "debug1.sh",
    "redeploy.sh",
    "deploy_only.sh",
    "build.log",
    "run.log",
    "panic.txt",
    "runB_markers.log",
    "fix_run_dmesg.txt",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}