DF-0718 PoC — smb_dev2share type-confuses non-vnode fd as vnode

Build (on guest, as any user)

cc -o panic panic.c
cc -o hunter hunter.c

(hunter.c warns about implicit kqueue() — harmless; add -include sys/event.h to silence.)

Or just: ./build.sh

Run (as root, after kldload smbfs)

./panic        # deterministic kernel PANIC on the buggy kernel
               #   (Fatal trap 12, smb_dev2share+0x59, fault 0x70098)
               # returns errno=22 (EINVAL) with NO panic on the FIXED kernel

./hunter       # broad sweep: socket/pipe/kqueue fds
               #   BUGGY:   errno=9 (EBADF) — type-confusion path entered
               #   FIXED:   errno=22 (EINVAL) — DTYPE_VNODE check fires

Reproduce the fix

smb_dev.c is built into the smbfs.ko module. Apply fix.diff to /usr/src, rebuild just the module, install, reload:

cd /usr/src && patch -p1 < /path/to/fix.diff
cd /usr/src/sys/vfs/smbfs && \
    KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC make obj && \
    KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC make
cp /usr/obj/usr/src/sys/vfs/smbfs/smbfs.ko /boot/kernel/smbfs.ko
chmod 555 /boot/kernel/smbfs.ko
kldload smbfs          # (or kldunload+kldload if already loaded)

Re-run ./panic — it must return EINVAL with the kernel staying up.

Expected outcome

• Bug present (unpatched #0 smbfs.ko, sha d854773e…): panic → kernel panic (deterministic). hunter → every non-vnode fd returns EBADF.
• Bug fixed (patched smbfs.ko, sha 73038f80…): panic → EINVAL, kernel survives. hunter → every non-vnode fd returns EINVAL; vnode-non-device fd still EBADF (unchanged).

Notes

• The trigger must run as root: mount(2) of smbfs requires root (SYSCAP_RESTRICTEDROOT). This is a root→kernel path, not an unprivileged LPE.
• The deterministic panic requires SO_RCVLOWAT=3 so the misread v_type equals VBLK(3). Without shaping, default SO_RCVLOWAT=1 reads as VREG and the bug manifests as a (still-wrong) EBADF rather than a panic.

DF-0718 — smb_dev2share type-confuses non-vnode fd as vnode

Verdict: REPRODUCED — deterministic kernel panic via type confusion; FIX VALIDATED.

Summary

sys/netproto/smb/smb_dev.c:395 casts fp->f_data to struct vnode * without checking fp->f_type == DTYPE_VNODE. For a non-vnode fd (socket, pipe, kqueue), f_data is not a vnode — it is a struct socket * / struct pipe * / struct kqueue *. The code then feeds this type-confused pointer to vn_todev() (sys/kern/vfs_subr.c:2499), which reads vp->v_type and vp->v_rdev at vnode offsets inside the wrong struct. If the bytes that land at the v_type offset match VBLK(3)/VCHR(4), vn_todev returns the bytes at the v_rdev offset as a forged cdev_t, and smb_dev2share then runs SMB_GETDEV(dev) (smb_dev.c:405 = ((struct smb_dev*)dev)->si_drv1) which dereferences the forged pointer → page-fault panic.

Reproduction (deterministic panic)

The cast is unconditional, but whether it panics depends on the byte at the v_type offset (0xe8 = 232) inside the type-confused object. For a struct socket, offset 232 is so_rcv.ssb_lowat (the SO_RCVLOWAT value, default 1 = VREG, which makes vn_todev return NULL → benign EBADF). Setting SO_RCVLOWAT = 3 makes the kernel read VBLK(3) at the v_type offset, so vn_todev proceeds and returns so_rcv.ssb_mbmax (≈0x70000, non-NULL) as the forged cdev_t. SMB_GETDEV(dev)->si_drv1 (offset 0x98 in struct cdev) dereferences 0x70098 → Fatal trap 12, page fault.

panic.c: socket(AF_INET,SOCK_STREAM,0); setsockopt(SO_RCVLOWAT, 3);
         mount("smbfs", "/mnt/df0718", 0, &args)   // args.dev = the socket fd

Observed panic (deterministic across two fresh vm.sh reset with-src boots):

Fatal user address access from kernel mode from panic at ffffffff82602cc9
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address    = 0x70098
fault code               = supervisor read data, page not present
instruction pointer      = 0x8:0xffffffff82602cc9
Stopped at  smb_dev2share+0x59:   movq  0x98(%rax),%rax
db>

0x70098 = ssb_mbmax (≈0x70000) + 0x98 (cdev_t::si_drv1 offset) — exactly the SMB_GETDEV(dev)->si_drv1 wild dereference. The crash is inside smb_dev2share — the cited buggy function.

Mechanism (path:line)

1. sys/vfs/smbfs/smbfs_vfsops.c:137 — smbfs_mount calls smb_dev2share(args.dev, ...) with the user-supplied fd.
2. sys/netproto/smb/smb_dev.c:391 — holdfp_fdp(..., fd, FREAD|FWRITE) returns the struct file *. holdfp checks f_flag, not f_type. (Sockets carry FREAD|FWRITE — sys/kern/uipc_syscalls.c:127 — so holdfp succeeds.)
3. sys/netproto/smb/smb_dev.c:395 — vp = (struct vnode*)fp->f_data; with NO DTYPE_VNODE check. For a socket fd this is a struct socket *.
4. sys/netproto/smb/smb_dev.c:400 — dev = vn_todev(vp).
5. sys/kern/vfs_subr.c:2501-2504 — vn_todev reads vp->v_type and vp->v_rdev at vnode offsets inside the socket. With SO_RCVLOWAT=3, v_type reads as VBLK, the KKASSERT(vp->v_rdev != NULL) passes (v_rdev = ssb_mbmax ≈ 0x70000), and it returns that as dev.
6. sys/netproto/smb/smb_dev.c:405 — SMB_CHECKMINOR(dev) expands to sdp = SMB_GETDEV(dev) = ((struct smb_dev*)dev)->si_drv1 — dereferences 0x70098 → page fault panic.

Threat model / privilege boundary (Phase 6 escalation assessment)

The only caller of smb_dev2share is smbfs_vfsops.c:137 (the smbfs mount(2) path). mount(2) of smbfs requires root: sys/kern/vfs_syscalls.c:5383-5397 get_fscap() returns SYSCAP_RESTRICTEDROOT for smbfs (it is not in the nullfs/devfs/procfs/tmpfs/fusefs allowlist), and caps_priv_check() (sys/kern/kern_caps.c:328) rejects any non-root cred without that cap. vfs.usermount=1 does not help: the __SYSCAP_NOROOTTEST path still requires the cred to actually hold the RESTRICTEDROOT cap bit, which non-root creds do not.

Valid hard blocker — root-only reachability. The vulnerable write/deref is reachable only from an already-root context (mount(SMBFS,...)). Root→kernel is game-over by definition; there is no privilege boundary to cross, so no unprivileged→root escalation exists via this path. This is a root→kernel robustness/correctness gap: an unprivileged user cannot reach smb_dev2share at all.

The primitive itself is a real memory-corruption type-confusion: a root attacker controls the forged cdev_t value via socket-buffer shaping (SO_RCVLOWAT sets the v_type byte; ssb_mbmax/ssb_hiwat shape the v_rdev/v_un fields), producing a semi-controlled kernel pointer dereference. If an unprivileged path to smb_dev2share ever existed, the chain would be: forge cdev_t → control SMB_GETDEV(dev)->si_drv1 → fake struct smb_dev with a crafted sd_share → hijack smb_share ops. No such unprivileged path exists on this kernel, so the demonstrated impact is a root-triggered kernel panic (DoS / type confusion), Medium severity — matching the finding's CVSS AV:L/AC:L/PR:H/.../A:H.

Fix

Add a DTYPE_VNODE check before the cast so non-vnode fds are rejected with EINVAL (and fdrop'd) before any type confusion:

fp = holdfp_fdp(..., fd, FREAD|FWRITE);
if (fp == NULL) return EBADF;
if (fp->f_type != DTYPE_VNODE) { error = EINVAL; goto done; }   /* NEW */
vp = (struct vnode*)fp->f_data;

See fix.diff (git-apply-able). smb_dev.c is compiled into the smbfs.ko module (sys/vfs/smbfs/Makefile), so the fix ships as a module rebuild — no full kernel rebuild required.

Fix validation (Phase 8) — VALIDATED

The fix is deterministic: the panic path returns EINVAL and the guest stays up; the legitimate vnode-non-device path is unchanged. fix_status = fixed.

Files

• panic.c — deterministic panic trigger (shapes socket SO_RCVLOWAT=3).
• hunter.c — broad fd-type sweep (shows the type-confusion path is entered for every non-vnode fd; the EBADF→EINVAL delta is the fix signal).
• fix.diff — the DTYPE_VNODE check (git-apply-able).
• build.sh / run.sh — exact build/run.
• run.log / fix_run.log / fix_run.2.log — full untrimmed run output.
• fix_build.log — patched-module build output.
• panic.txt — the panic signature from dfbsd-qemu/boot.log.
• dmesg.txt — kernel invalid device handle N (errno) lines.
• env.txt — guest environment.