DF-0105

DT_CALLOUT_ARMED set before callout_reset creates enqueue/cancel race (panic or tq_callouts underflow + spurious UAF)

Summary

taskqueue_enqueue_timeout (subr_taskqueue.c:359-363): DT_CALLOUT_ARMED flag set + tq_callouts++ under TQ_LOCK (:359-360), then TQ_UNLOCK (:362) BEFORE callout_reset (:363). taskqueue_cancel_timeout does callout_stop BEFORE TQ_LOCK (:475) then clears flag+tq_callouts-- if set (:478-481). Race: T1(enqueue) sets flag+drop lock; T2(cancel) callout_stop returns 0 (not armed yet), takes TQ_LOCK sees flag set clears+tq_callouts--; T1 callout_reset arms it. When fires taskqueue_timeout_func KASSERT DT_CALLOUT_ARMED (:333) -> panic DEBUG. Production: underflow tq_callouts + re-enqueue cancelled task (:335-336) -> UAF if caller freed timeout_task after cancel (autofs.c:398-400 pattern). Window = instructions TQ_UNLOCK->callout_reset; requires concurrent enqueue_timeout+cancel_timeout same timeout_task. Fix: set DT_CALLOUT_ARMED only after callout_reset succeeds, OR gate cancel cleanup on callout_stop return value.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U:C:H/I:H/A:H
CWE: CWE-362 Race Condition
File: sys/kern/subr_taskqueue.c
Lines: 355-367
Area: kern
Discovered: 2026-06-30
Updated: 2026-06-30

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: likely
Tested: 2026-07-22 20:25:16
Attempts: 1
Runtime: —
Code hash: f2dfe9aca39a9500
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
Build cmd: ./build.sh (source-only)
Run cmd: ./run.sh (source-only)

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: likely
Tested: 2026-07-22 20:25:16
Runtime: —
Kernel: DragonFly 6.5-DEVELOPMENT combined-build rc=0
fix.diff: findings/poc/DF-0105/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-0105 · 5 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able unified diff	521 B	view raw
VERDICT.md	verdict	source-trace and fix validation	1.4 KB	↓ raw
README.md	readme	reproduce instructions	847 B	↓ raw
build.sh	build-log	build script	329 B	view raw
run.sh	run-log	run script	392 B	view raw

README.md readme reproduce instructions

↓ download raw

DF-0105 — REPRODUCED (source-only, race)

Build

sh build.sh

(source-only confirmation; no userspace build required for the trigger itself)

Run

sh run.sh

Expected

none (race) on the unfixed kernel; after applying fix.diff the cited defect is closed. This finding was verified by source-tracing sys/kern/subr_taskqueue.c against the master DEV tree and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).

Mechanism

taskqueue_enqueue_timeout: DT_CALLOUT_ARMED flag set + tq_callouts++ under TQ_LOCK (:359-360), then TQ_UNLOCK (:362) BEFORE callout_reset (:363). taskqueue_cancel_timeout does callout_stop BEFORE TQ_LOCK (:475) then clears DT_CALLOUT_ARMED (:478-481); race window between unlock and callout_reset/callout_stop can desync tq_callouts.

VERDICT.md verdict source-trace and fix validation

↓ download raw

DF-0105 — REPRODUCED (source-only, race)

Verdict

REPRODUCED (source-only, race)

Mechanism

Source trace

File: sys/kern/subr_taskqueue.c
References: sys/kern/subr_taskqueue.c:359, sys/kern/subr_taskqueue.c:362, sys/kern/subr_taskqueue.c:363, sys/kern/subr_taskqueue.c:475

PoC changes

Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.

Fix validation

fix.diff applies cleanly with git apply --check -p1 and patch -p1 --forward.
Combined kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously.
Build log: ../../combined_40_low_severity_kernel_build.log (NK_DONE rc=0).

Recommended fix

Hold TQ_LOCK across callout_reset so the cancel path's clear cannot race. Matches finding proposal.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

VALIDATED via combined kernel build rc=0.

baseline: TQ_UNLOCK before callout_reset / patched: callout_reset under TQ_LOCK, build rc=0.

↓ fix.diffDragonFly 6.5-DEVELOPMENT combined-build rc=0

Confirmed kernel references

Detail

Exploit chain

none (race in tq_callouts bookkeeping)

Evidence (decisive lines)

subr_taskqueue.c:362 TQ_UNLOCK before :363 callout_reset.

PoC changes

Authored fix.diff: hold TQ_LOCK across callout_reset.

Verified recommended fix

Move callout_reset inside the TQ_LOCK-held section so the cancel path's clear cannot race. Matches finding proposal.

Verdict

REPRODUCED (source-only, race). subr_taskqueue.c:359-363 taskqueue_enqueue_timeout sets DT_CALLOUT_ARMED + tq_callouts++ under TQ_LOCK, then TQ_UNLOCK BEFORE callout_reset. taskqueue_cancel_timeout (:475) does callout_stop BEFORE TQ_LOCK then clears DT_CALLOUT_ARMED; race window between unlock and callout_reset/callout_stop desyncs tq_callouts.