⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0116

copyin/copyout/uiomove_nofault clear TDF_NOFAULT unconditionally instead of save/restore

Summary

copyin_nofault(:60-70), copyout_nofault(:72-82), uiomove_nofault(:206-216) use atomic_clear_int(TDF_NOFAULT) unconditionally on exit, unlike uiomove_fromphys(:612-616) which saves/restores. If invoked from a context already holding TDF_NOFAULT set (nested no-fault copy), outer caller loses protection. No unprivileged trigger found. Defense-in-depth.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0116 · 1 files
FileTypeDescriptionSize
manifest.json file 389 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/kern/kern_subr.c:60: copyin/out_nofault clear TDF_NOFAULT unconditionally instead of save/restore

Verified recommended fix

Source-confirmed at sys/kern/kern_subr.c:60: copyin/out_nofault clear TDF_NOFAULT unconditionally instead of save/restore

Verdict

Source-confirmed at sys/kern/kern_subr.c:60: copyin/out_nofault clear TDF_NOFAULT unconditionally instead of save/restore