⬢ DragonFlyBSD Kernel Audit
DF-4607 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4607",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Unlocked DANGER1/DANGER2 transitions in ata_completed() (ata-queue.c:308-317) let the 4x-timeout direct completion (ata-queue.c:144-151) and a finally-arriving taskqueue completion execute the completion body concurrently: duplicate reinject/callback/COMPLETED, then the zombie branch frees the request (ata_free_request at :313) while the other thread is mid-body (UAF), after which the submitters unconditional ata_free_request (ata-queue.c:182/:209) double-puts the zeroed object into ata_request_cache. The sequential orders are safe (the DANGER2 guard in ata-all.h:605-611 no-ops the callers free), only the concurrent order breaks. Not reproduced on the guest: the precondition is a >=40 s channel/taskqueue stall plus a boundary-coincident completion, and the QEMU-backed channel completes 512MB in 0.69s with no stall dial available (stress.log). Race is code-certain; trigger is a real-world hardware-distress event.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4607/VERDICT.md (interleaving trace), stress.log (precondition measurement), fix.diff (serialized transitions + idempotent completion)",
  "kernel_refs": [
    "sys/dev/disk/nata/ata-queue.c:140",
    "sys/dev/disk/nata/ata-queue.c:144",
    "sys/dev/disk/nata/ata-queue.c:150",
    "sys/dev/disk/nata/ata-queue.c:308",
    "sys/dev/disk/nata/ata-queue.c:313",
    "sys/dev/disk/nata/ata-queue.c:317",
    "sys/dev/disk/nata/ata-queue.c:182",
    "sys/dev/disk/nata/ata-all.h:605"
  ],
  "poc_changes": "No executable PoC exists for this window; the attempt was an in-situ stress of the guest channel to test whether the 4x-timeout precondition can be reached (it cannot: 0.69s for 512MB, zero timeout messages).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "vm.sh run_root dd if=/dev/zero of=/tmp/stress bs=1m count=512; dmesg | grep -ciE \"taskqueue timeout|TIMEOUT.*retry|ata.*timeout\"",
  "code_hash": "",
  "notes": "Trigger requires hardware distress (failing disk / lost interrupt / taskqueue starvation >= 40 s) coinciding with the real completion inside the direct calls window; unproducible on the emulated PIIX3. Same-family window as DF-4606 but distinct mechanism (DANGER flag race vs callout-cancel deadlock).",
  "recommended_fix": "Serialize the DANGER1/DANGER2 transitions and zombie free on request->done and early-out when ATA_R_COMPLETED is already set (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored; baseline not stageable on this guest hardware, so no patched-kernel comparison is possible.",
  "fix_evidence": "findings/poc/DF-4607/fix.diff"
}