⬢ DragonFlyBSD Kernel Audit
DF-3303 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-3303",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Code-certain lock-discipline race: del_mfc (:1115-1118) and del_bw_upcall DELETE_ALL (:2365-2368) run free_bw_list() after lwkt_reltoken(), and unschedule_bw_meter() (:2653-2672) mutates the global bw_meter_timers[] hash unlocked, racing the token-holding 1 Hz bw_meter_process() (:2715-2761) which disconnects and relinks whole buckets; collision => panic(unschedule_bw_meter: bw_meter entry not found) (:2663) or UAF reschedule of a freed meter. Six escalating guest attempts (up to 240s, 4 adder + 4 deler threads at 10ms, traffic-suppressed upcall storm, 120k-300k-meter burst variants) did not land the interleaving: the deleters detach needs the token the callout holds across its walk, and free walks are fast (low duty cycle vs the 1 Hz tick). FreeBSD frees this list under the lock. Recorded collateral: bw_upcalls_send MGETHDR+m_copyback(10KB) fails (m_copyback: unexpected mbuf expansion required) losing upcalls and flooding the console; scheduled meters outliving their daemon churn the callout forever.",
  "exploit_chain": "",
  "evidence": [
    "run.log (bwrace phases, no panic)",
    "fix_run.log (45s on patched kernel, no regression)",
    "VERDICT.md (full attempt history and mechanics)"
  ],
  "kernel_refs": [
    "sys/net/ip_mroute/ip_mroute.c:1115",
    "sys/net/ip_mroute/ip_mroute.c:2365",
    "sys/net/ip_mroute/ip_mroute.c:2641",
    "sys/net/ip_mroute/ip_mroute.c:2663",
    "sys/net/ip_mroute/ip_mroute.c:2715"
  ],
  "poc_changes": "Multiple redesigns: v1 dedupe bug (identical meters collapse to one - add_bw_upcall dedupes); v2 burst design starved the box with upcall-storm console spew; v3 traffic-suppressed thresholds + continuous add/del threads. Final: 4 adders + 4 delers@10ms + trafficker.",
  "attempts": 6,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Sep 10 09:22:03 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PIMTEST x86_64",
  "runtime_sec": 900,
  "guest_dirty": 1,
  "build_cmd": "cc -O2 -Wall -pthread -o bwrace bwrace.c",
  "run_cmd": "./bwrace 200",
  "code_hash": "7d8c1fa0cda2e11e98603333b1ab1bd32cc2bfd4ed455c32aab773f65ebe6047",
  "notes": "Trigger is privileged (MRT_DEL_MFC / MRT_DEL_BW_UPCALL) - severity capped at Medium (DF-0306 family profile). The bw_upcalls_send 10KB m_copyback failure and the post-daemon-death meter churn are real secondary defects worth separate Low filings.",
  "recommended_fix": "Keep mroute_token held across free_bw_list() in del_mfc and del_bw_upcall (FreeBSD order); optionally assert token-hold inside unschedule_bw_meter.",
  "fix_status": "inconclusive",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Thu Sep 10 10:33:47 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PIMTEST x86_64",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix builds and boots; bwrace 45s no-regression run clean. Since the baseline race never landed on the guest, fix efficacy against the race itself is proven by construction (free path now under the same token as the timer walk), not by differential crash testing.",
  "fix_evidence": "fix_build.log; fix_run.log"
}