⬢ DragonFlyBSD Kernel Audit
DF-4984 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
{
  "finding_id": "DF-4984",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Dead scratch code with zero attack surface: absent from dm Makefile SUBDIR and sys/conf/files, no Makefile in snapshot/, zero references to any of its symbols in sys/, no dm_target_alloc/dm_target_insert self-registration, and it cannot even link if force-built (bare snprintf at :319; DFly kernel only has ksnprintf, systm.h:222). Latent bugs catalogued so they are never revived: (L1) init reads argv[0..3] with no argc check while dm_table_init M_ZERO-fills argv so short table lines put NULL into strcmp/atoi64/dm_pdev_insert -> NULL-deref panic; (L2) non-persistent snapshot passes NULL pdev to dm_table_add_deps -> KKASSERT(dm_table.c:277) panic at load, masking (L3) the unconditional tsc_cow_dev->name kprintf deref (:192-194, name at dm.h:114 offset 0); (L4) error path :140-141 leaks tsc and pins the snap pdev vnode (flakey twin DF-4922); (L5) dm_target_snapshot_orig_table returns a kmem_alloc(VM_SUBSYS_DM) pointer which the core kfrees with M_DM (dm_ioctl.c:993) -> cross-allocator heap corruption; (L6) orig_destroys extra dm_target_unbusy (:359) plus the cores unbusy (dm_table.c:157) double-decrements -> KKASSERT panic / unload UAF; (L7) strategy handlers are EIO stubs - the target was never functional. Delete-the-directory fix (dmirror DF-4973 precedent).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4984/VERDICT.md sections 1-2 (three independent dead-code proofs + seven latent shapes, each with path:line); README.md reproduction greps",
  "kernel_refs": [
    "sys/dev/disk/dm/snapshot/dm_target_snapshot.c:113-154",
    "sys/dev/disk/dm/snapshot/dm_target_snapshot.c:140-141",
    "sys/dev/disk/dm/snapshot/dm_target_snapshot.c:146-149",
    "sys/dev/disk/dm/snapshot/dm_target_snapshot.c:192-194",
    "sys/dev/disk/dm/snapshot/dm_target_snapshot.c:313",
    "sys/dev/disk/dm/snapshot/dm_target_snapshot.c:319",
    "sys/dev/disk/dm/snapshot/dm_target_snapshot.c:359",
    "sys/dev/disk/dm/Makefile:7",
    "sys/conf/files:48-60",
    "sys/dev/disk/dm/dm_ioctl.c:824",
    "sys/dev/disk/dm/dm_ioctl.c:993",
    "sys/dev/disk/dm/dm_table.c:157",
    "sys/dev/disk/dm/dm_table.c:277",
    "sys/dev/disk/dm/dm_target.c:57-59",
    "sys/dev/disk/dm/dm_pdev.c:121",
    "sys/dev/disk/dm/device-mapper.c:181",
    "sys/dev/disk/dm/device-mapper.c:584-597"
  ],
  "poc_changes": "not applicable - no PoC; static dead-code proof (stronger than dmirrors build transcript: file is not merely non-compiling, it is unbuildable and unregistered by construction)",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "pass 2 (GLM 5.3). No pass-1 findings existed on this file. The mirror/ directory (dm_target_mirror.c) is likewise absent from the build - already implicitly covered by DF-4973s family sweep; this finding completes the dm family: every dm file is now audited.",
  "recommended_fix": "Delete sys/dev/disk/dm/snapshot/ (or, if revived: argc==4 validation, persistent-only cow deps, dm_alloc_string in both table funcs, remove extra dm_target_unbusy in orig_destroy, error-path kmem_free+dm_pdev_decr).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable - dead code; nothing to build a fix kernel against (file is not compiled)",
  "fix_evidence": ""
}