⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0085

taskqgroup_drain_all uses wrong loop bound (ncpus instead of tqg_cnt) - latent UAF if API adopted

Summary

taskqgroup_drain_all (subr_gtaskqueue.c:811): iterates for(i=0;i<ncpus;i++) instead of i<tqg_cnt. tqg_queue[MAXCPU] no OOB (ncpus<=MAXCPU) but if taskqgroup created with cnt>ncpus (:783 no upper bound) drain misses queues [ncpus,cnt) -> tasks remain pending. Caller freeing task memory after drain -> UAF. No in-tree caller; only softirq group cnt==ncpus (:51). Latent correctness bug for future API adopter.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0085 · 5 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff 331 B view raw
VERDICT.md verdict source-trace and fix validation 1.2 KB ↓ raw
README.md readme reproduce instructions 774 B ↓ raw
build.sh build-log build script 329 B view raw
run.sh run-log run script 392 B view raw
README.md readme reproduce instructions
↓ download raw

DF-0085 — REPRODUCED (source-only)

Build

sh build.sh

(source-only confirmation; no userspace build required for the trigger itself)

Run

sh run.sh

Expected

none (drain incompleteness) on the unfixed kernel; after applying fix.diff the cited defect is closed. This finding was verified by source-tracing sys/kern/subr_gtaskqueue.c against the master DEV tree and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).

Mechanism

taskqgroup_drain_all iterates for(i=0;i<ncpus;i++) instead of i<tqg_cnt. tqg_queue[MAXCPU] so no OOB (ncpus<=MAXCPU) but if taskqgroup created with cnt>ncpus (:783 no upper bound) drain misses queues [ncpus,cnt) → tasks remain pending after drain.

VERDICT.md verdict source-trace and fix validation
↓ download raw

DF-0085 — REPRODUCED (source-only)

Verdict

REPRODUCED (source-only)

Mechanism

taskqgroup_drain_all iterates for(i=0;i<ncpus;i++) instead of i<tqg_cnt. tqg_queue[MAXCPU] so no OOB (ncpus<=MAXCPU) but if taskqgroup created with cnt>ncpus (:783 no upper bound) drain misses queues [ncpus,cnt) → tasks remain pending after drain.

Source trace

PoC changes

Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.

Fix validation

  • fix.diff applies cleanly with git apply --check -p1 and patch -p1 --forward.
  • Combined kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously.
  • Build log: ../../combined_40_low_severity_kernel_build.log (NK_DONE rc=0).

Iterate i < tqg->tqg_cnt instead of i < ncpus. Matches finding proposal.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED via combined kernel build rc=0.

baseline: i<ncpus loop / patched: i<tqg->tqg_cnt, build rc=0.
↓ fix.diffDragonFly 6.5-DEVELOPMENT combined-build rc=0

Confirmed kernel references

Detail

Exploit chain

none (drain incompleteness)

Evidence (decisive lines)

subr_gtaskqueue.c:811 uses ncpus instead of tqg->tqg_cnt.

PoC changes

Authored fix.diff: iterate i < tqg->tqg_cnt.

Verified recommended fix

Iterate i < tqg->tqg_cnt instead of i < ncpus. Matches finding proposal.

Verdict

REPRODUCED (source-only). subr_gtaskqueue.c:811 taskqgroup_drain_all iterates for(i=0;i<ncpus;i++) instead of incpus (:783 no upper bound), drain misses queues [ncpus,cnt) → tasks remain pending after drain.