# DF-4148 — cuse client-open vs server-teardown UAF/double-free race

## What (code trace — not reproduced on the guest)

`cuse_client_open()` (`cuse.c:1497-1531`) loads `pcsd = dev->si_drv1`
**unlocked** (1509), then dereferences `pcsd->server`/`pcsd->user_dev`
(1511-1512), takes `pcs->mtx` and does `pcs->refs++` (1521).

The final `cuse_server_unref()` (`cuse.c:685-732`) decrements `refs` to 0
under `pcs->mtx` (692) with **no re-check afterwards** and tears down:

* `cuse_server_free_dev()` NULLs `si_drv1` under `pcs->mtx` (668-669),
  calls `destroy_dev(pcsd->kern_dev)` (680) — on DragonFly this is
  **asynchronous** (`devfs_destroy_dev` → `lwkt_sendmsg`,
  `sys/vfs/devfs/devfs_core.c:755-763`; the "destroy device synchronously"
  comment at `cuse.c:679` is wrong for DFly) — and then `kfree(pcsd)` (682)
  **without waiting for in-flight `cuse_client_open` dispatches**;
* `kfree(pcs)` at 731 after the last unlock at 723.

Interleaving A (refs race): a client open that loaded `si_drv1` before the
NULL write but executes `refs++` after the final `--refs` (0→1) proceeds on
the dying server: `TAILQ_INSERT_TAIL(&pcs->hcli, pcc)` (1561) into memory
that is kfree'd at 731, and since `is_closing` was already set its error
path (1564-1574) runs `devfs_clear_cdevpriv` → `cuse_client_free` →
`cuse_server_unref` (refs 1→0) → a **second full teardown**: second
`TAILQ_REMOVE` from `cuse_server_head` (already removed at 701, stale
tqe pointers → global-list corruption), re-walk of `hdev` racing thread 1
→ double `destroy_dev`/`kfree(pcsd)`, and double `kfree(pcs)`.

Interleaving B (pcsd UAF): open loads `pcsd`, is preempted before `pcs =
pcsd->server`; teardown completes `kfree(pcsd)` (682) → open dereferences
freed memory, then `cuse_server_lock()` on freed/uninited `pcs->mtx`
(lockmgr writes into freed memory).

Trigger surface: an unprivileged user can hammer `open()` on a world-writable
cuse device node; the server side must be exiting at the same moment (daemon
restart/crash).  Both sides were driven as root in the PoC below.

## Guest attempt — honest result

`cuse_race.c`: 6 cycler processes doing tight open/close loops against a
pumper that services OPEN/CLOSE commands for ~1 s and then closes `/dev/cuse`
to start the teardown (whose `cuse_server_free` wait-loop polls refs at 1 Hz,
so each round's teardown races the cyclers' in-flight opens).

* run 1: 120 rounds — `all 120 rounds done, guest alive`
* run 2: 300 rounds — `all 300 rounds done, guest alive`

**No panic, no guest death in 420 teardown races** ⇒ `not_reproduced`.
The per-round hit window is only a few µs wide against a teardown that
itself takes ~µs; the trace stands but the practical hit-rate on this
6-vCPU guest was too low.  Two supporting observations were recorded:
a pumper parking in `cuse_server_free`'s wait loop for >60 s mid-run
(transient ref oscillation), and — during harness debugging — wedged
D-state clients that keep an inherited `/dev/cuse` fd alive, which also
demonstrates that teardown of a cuse server with blocked clients never
completes (operational DoS amplifier, see DF-4149).

## Fix

`fix.diff` (authored, **not** guest-validated — no reproducer exists):

1. serialize the final decrement and the open-side increment under
   `cuse_global_mtx` and add a `dying` flag set before teardown starts;
   `cuse_client_open` checks `dying`/NULL under the same lock **before**
   touching `pcsd->server` or bumping refs;
2. NULL `si_drv1` in `cuse_server_free_dev` under `cuse_global_mtx`
   (matching the open-side read).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.