⬢ DragonFlyBSD Kernel Audit
DF-5321 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-5321",
  "title": "fw_xfer/tlabel use-after-free and double completion: firewire_xfer_timeout() vs fw_rcv() + FW_ASYREQ waiter (no cross-CPU serialization)",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh   (on the guest, root: builds df5321.ko, compiling the PRODUCTION sys/bus/firewire/firewire.c)",
    "run": "sh run_mode1.sh   (mode 1: FW_ASYREQ scenario)  or  sh run.sh  (mode 2: production fw_asy_callback_free)",
    "expected": "Fatal trap 12: page fault, supervisor read data, fault virtual address 0x8, Stopped at firewire_xfer_timeout+0xbc: movq 0x8(%rax),%rax  (freed struct tlabel dereferenced by the watchdog; guest down at db>)"
  },
  "kernel_refs": [
    "sys/bus/firewire/firewire.c:320",
    "sys/bus/firewire/firewire.c:336",
    "sys/bus/firewire/firewire.c:341",
    "sys/bus/firewire/firewire.c:348",
    "sys/bus/firewire/firewire.c:349",
    "sys/bus/firewire/firewire.c:890",
    "sys/bus/firewire/firewire.c:910",
    "sys/bus/firewire/firewire.c:1757",
    "sys/bus/firewire/firewire.c:1779",
    "sys/bus/firewire/firewire.c:1786",
    "sys/bus/firewire/firewire.c:1789",
    "sys/bus/firewire/firewire.c:1078",
    "sys/bus/firewire/firewire.c:2169",
    "sys/bus/firewire/firewirereg.h:130"
  ],
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff serializes the tlabel lists with fc->tlabel_lock (fw_get_tlabel/fw_tl_free/fw_tl2xfer/firewire_xfer_timeout), claims completion atomically with the lookup (CAS FWXF_SENT->FWXF_RCVD), runs fw_xfer_done outside the lock, and kfrees the timeout-unlinked tlabel (also DF-5322). Applied to guest /usr/src; module rebuilt; identical triggers: baseline panics (both modes, attempt #1) -> fixed completes 3000/5000 attempts with zero double-completions, zero stale stores, zero leak, guest up.",
  "fix_evidence": "fix_run.log, fix_build.log",
  "artifacts": [
    "df5321.c", "Makefile", "build.sh", "run.sh", "run_mode1.sh",
    "run.log", "run_mode1_console.log", "panic.txt",
    "fix.diff", "fix_build.log", "fix_run.log",
    "env.txt", "VERDICT.md", "README.md", "manifest.json", "verdict.json"
  ]
}