⬢ DragonFlyBSD Kernel Audit
DF-4274 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-4274",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Deterministic code-path defect (proven by trace, not runtime): a passthrough request whose bus_dmamap_load defers with EINPROGRESS and whose deferred CL submission then fails is inserted into TW_OSLI_FREE_Q twice - once by twa_map_load_data_callbacks error path (tw_osl_freebsd.c:1282-1283) and once by the woken ioctl thread unwinding at fw_passthru_err (tw_osl_freebsd.c:1049) - corrupting the request queue (self-ring link) and allowing the same tw_osli_req_context to be owned by two threads (second owners req->data freeable by the first owners kfree at :1047-1048). Latent on current x86-64 defaults: EINPROGRESS requires addr_needs_bounce() to fire, which the twa tags (lowaddr=highaddr=BUS_SPACE_MAXADDR, alignment=4 < PAGE_SIZE, page-granular bounce test) can never trigger; it goes live under any busdma config that bounces these loads. Could not be exercised at runtime: /dev/twa0 is 0600 root-only and the audit guest has no 3ware HBA.",
  "exploit_chain": "concurrent root ioctls on /dev/twa0 with data buffers -> EINPROGRESS deferral (bounce pressure) -> CL submit failure (request-pool exhaustion / controller fault) -> request double-inserted into free queue -> two threads pop the same request -> double kfree(req->data) / UAF (kernel heap corruption potential, race-dependent)",
  "evidence": "VERDICT.md (step-by-step trace with path:line for both insertions, the wake ordering, the sync-path counterexample, and the platform-reachability analysis); fix.diff",
  "kernel_refs": [
    "sys/dev/raid/twa/tw_osl_freebsd.c:1273",
    "sys/dev/raid/twa/tw_osl_freebsd.c:1282",
    "sys/dev/raid/twa/tw_osl_freebsd.c:1390",
    "sys/dev/raid/twa/tw_osl_freebsd.c:1397",
    "sys/dev/raid/twa/tw_osl_freebsd.c:1040",
    "sys/dev/raid/twa/tw_osl_freebsd.c:1049",
    "sys/dev/raid/twa/tw_osl_freebsd.c:1098",
    "sys/dev/raid/twa/tw_osl_freebsd.c:1101",
    "sys/platform/pc64/x86_64/busdma_machdep.c:640",
    "sys/platform/pc64/x86_64/busdma_machdep.c:793",
    "sys/dev/raid/twa/tw_cl_io.c:283",
    "sys/dev/raid/twa/tw_osl_cam.c:335"
  ],
  "poc_changes": "n/a (finding originated in this run; no PoC exists - hardware-gated)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Confidence likely: the double-insert is certain from the code once EINPROGRESS+submit-error occur, but the preconditions are not producible on the audit guest (no 3ware HBA; twa tags cannot bounce on default x86-64). Sibling of twe DF-4178 family (free-while-in-flight lifecycle defect). Impact none = nothing observed at runtime.",
  "recommended_fix": "In twa_map_load_data_callbacks error path, skip the free-queue insertion for PASSTHRU requests - the sleeping originator in tw_osli_fw_passthru returns the request itself (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-accurate root cause; not build/boot-validated - the driver cannot attach on the audit guest and the triggering deferral cannot be generated on this platform",
  "fix_evidence": "findings/poc/DF-4274/fix.diff (conditional excludes TW_OSLI_REQ_FLAGS_PASSTHRU from the callback-side reinsert at tw_osl_freebsd.c:1282)"
}