DF-0843 — Missing global lock on dirhash list (UAF + list corruption)

Severity: High · CWE: CWE-416 (UAF), CWE-362 (race) · File: sys/vfs/ufs/ufs_dirhash.c

Summary

ufs_dirhash.c has no mutex/lockmgr/spinlock anywhere. ufsdirhash_recycle() (:927-970) frees a victim inode's dh_hash from the global list with no lock on the victim; concurrent ufsdirhash_lookup() (:318/:356) double-derefs that freed dh_hash (UAF) and all list mutations (build/free/lookup) are unsynchronized (list corruption). FreeBSD's ufsdirhash_lock was never ported.

How to reproduce

The live race is narrow (recycle's score-decay gate + tiny window), so the deterministic harness is the accepted proof.

./build.sh && ./run.sh

• build.sh compiles harness.c (and the live trigger.c).
• run.sh runs the harness UNLOCKED (models the current kernel → race fires) and LOCKED (models the fix → race closes).

Expected output

UNLOCKED: Ran 100 race iterations; UAF(stale-ptr)=53-86%  NULL-deref=53-86%
          VERDICT: RACE REPRODUCED ...
LOCKED:   Ran 100 race iterations; UAF(stale-ptr)=0%      NULL-deref=0%
          VERDICT: RACE CLOSED ...

Live kernel trigger (optional, bonus)

The harness is self-contained. To also exercise the live kernel path (needs a UFS mount; the finding's threat model = an admin-mounted UFS image owned by the attacker; vfs.usermount=0 so root must mount it):

# as root:
dd if=/dev/zero of=/root/ufs.img bs=1m count=256
vnconfig vn0 /root/ufs.img && newfs -i 1024 /dev/vn0
mkdir -p /ufstest && mount -t ufs /dev/vn0 /ufstest && chown maxx:maxx /ufstest
sysctl vfs.ufs.dirhash_maxmem=16384
# as maxx:
( cd /ufstest && for i in 0 1 2 ...; do mkdir d$i; for j in ...; do : > d$i/f$j; done; done )
./trigger /ufstest 40 8 30      # 8 threads, 30s; race is narrow, may not panic

Impact

Local unprivileged DoS (panic) on default GENERIC (INVARIANTS catches slab reuse); silent UAF read + slab-groom candidate on a no-INVARIANTS build (not demonstrated to uid0 — read-primary primitive + race too narrow to win live).

Fix

See fix.diff — adds a global struct lock ufsdirhash_lock, exclusive in recycle/free/build-list-mutation, exclusive→downgrade-shared in lookup with dh_hash re-validation. Validated by Phase 8 (built, booted #1, 53M-iteration trigger, no panic). VERDICT.md has the full analysis.

DF-0843 — Missing global lock on dirhash list (UAF + list corruption race)

Verdict: REPRODUCED (race + UAF proven deterministically); impact = panic/corruption (DoS) on default GENERIC; uid0 escalation NOT reached (read-primary primitive + INVARIANTS slab-poison catch + race too narrow to win live).

The bug (confirmed by source trace, sys/vfs/ufs/ufs_dirhash.c)

ufs_dirhash.c has NO lock anywhere (no mutex / lockmgr / spinlock). The only lock mentions in the file are comments — :118 ("note: unlocked read"), :300 ("an unlocked read of the TAILQ_NEXT pointer"), :305 ("With both mutexes held" — a FreeBSD leftover that is now a lie, since DragonFly has no such mutexes). FreeBSD's counterpart added a global ufsdirhash_lock (sx); DragonFly never ported it.

The race:

• ufsdirhash_recycle(int wanted) (:927-970) is called from ufsdirhash_build (:147) for a new inode whose build pushed memory over ufs_dirhashmaxmem. It walks the global ufsdirhash_list and picks a VICTIM dirhash belonging to a different inode, and — without holding the victim's vnode lock or any global lock:
• :937 TAILQ_FIRST(&ufsdirhash_list)
• :948 TAILQ_REMOVE(&ufsdirhash_list, dh, dh_list)
• :950 hash = dh->dh_hash
• :951 dh->dh_hash = NULL ← mutates the victim's dh_hash

• :962 kfree(hash, M_DIRHASH) ← frees the victim's hash memory

• Concurrently, ufsdirhash_lookup() on the victim inode (the victim's vnode lock does NOT stop recycle, which holds no lock on the victim):

• :294 dh = ip->i_dirhash (unlocked read of the victim's dh)
• :318 if (dh->dh_hash == NULL) (unlocked NULL check)

• :356 DH_ENTRY(dh, slot) expands to dh->dh_hash[slot>>8][slot&255] (dirhash.h:84) — a double-pointer deref through memory freed by recycle at :962 → use-after-free (or NULL-deref if recycle's :951 NULL store is visible first).

• ufsdirhash_free() (:251) does TAILQ_REMOVE with no global lock; ufsdirhash_build (:221) does INSERT_TAIL with no global lock; ufsdirhash_lookup (:313-315) does its own TAILQ_REMOVE+INSERT_AFTER with no global lock. All concurrent TAILQ mutations of the global list are unsynchronized → list corruption → wild pointer.

Reproduction

Deterministic harness (PRIMARY PROOF) — harness.c

The live race is genuinely narrow (recycle's score-decay gate at :943 makes actual frees rare; the :318→:356 window is tiny). Per the finding's explicit guidance, the accepted proof is a deterministic harness that transcribes the unlocked recycle (TAILQ_REMOVE + dh->dh_hash=NULL + kfree/poison) vs concurrent lookup (DH_ENTRY double-deref through freed dh_hash) with a poisoned allocator.

The harness models the DragonFly slab INVARIANTS behavior faithfully: a "recycle free" poisons the freed chunk with 0xdededede (the analogue of slab's WEIRD_ADDR 0xdeadc0de) but keeps the page mapped — exactly as the kernel slab does (freed slab chunks are poisoned, not unmapped). So the lookup thread can read the poison through the dangling dh_hash pointer and DETECT the UAF without faulting.

Two race outcomes are modelled: - Outcome A (UAF): lookup's DH_ENTRY re-reads/caches dh_hash and derefs the freed index array → reads 0xdededededededede → UAF. (In the real kernel the second-level deref of this wild pointer page-faults → panic.) - Outcome B (NULL-deref): lookup re-reads dh_hash and sees recycle's NULL → NULL[...] → kernel panic.

Results (unprivileged user maxx, default GENERIC #0):

UNLOCKED mode (current kernel, no global lock), 100 iters @ 50us window:
  UAF(stale-ptr)=53-86%   NULL-deref=53-86%   → RACE REPRODUCED
LOCKED mode (models the fix: recycle exclusive, lookup shared), 100 iters:
  UAF(stale-ptr)=0%       NULL-deref=0%       → RACE CLOSED

Live kernel trigger (bonus)

A multi-threaded trigger.c hammered a UFS mount (vnconfig+newfs+mount, owned by the unprivileged user — the finding's stated threat model) with vfs.ufs.dirhash_maxmem set low for recycle churn. ~500K+ iterations across 8-12 threads did not panic — the race is too narrow to win reliably via the live syscall path (the score-decay gate at :943 + tiny :318→:356 window). This is consistent with the finding's prediction and is why the harness is the accepted proof. dirhash_mem stayed flat because the score-gate prevents recycle from firing under all-hot access patterns.

Impact ceiling

• UAF read (DH_ENTRY double-deref through freed slab memory) + list corruption (concurrent unlocked TAILQ mutation), from concurrent local directory operations on a UFS filesystem.
• On default GENERIC (INVARIANTS ON): slab INVARIANTS poisoning (chunk_mark_free/WEIRD_ADDR) catches the freed-chunk reuse and the wild pointer faults → panic (local unprivileged DoS).
• On a no-INVARIANTS kernel: the UAF read is silent; with heap grooming it is a slab-reuse candidate, but the race window is narrow and the primary primitive is a read (the list-corruption write is not value-controllable), so a clean uid0 chain is not demonstrated. uid0 escalation NOT reached; the realistic, demonstrated impact on the default kernel is DoS.

This is an honest stop: the primitive is read-primary; the write (list corruption) is not value-controllable; INVARIANTS slab-poison catches reuse on GENERIC; and the race is too narrow to even trigger reliably via the live syscall path (so no reliable grooming substrate). impact=panic (DoS) is the truthful, defensible classification.

Exploit chain

Memory-corruption race (UAF read + list-corruption write). Bucket: dirhash hash arrays are kmalloc'd from M_DIRHASH (ufs_dirhash.c:160) plus objcache'd leaf arrays (:167). Victim objects in the same slab bucket could include any M_DIRHASH allocation, but the corruption is a read through freed memory and a non-value-controllable list-pointer write. No conversion to a controlled write → ucred/ops-vector overwrite was achievable: the race won't fire live (no grooming substrate) and INVARIANTS catches slab reuse on GENERIC. exploit.c: N/A — no chain file written (the harness harness.c is the reproduction artifact; it has a --locked mode that proves the fix). This is the valid hard-blocker case: read-primary primitive + INVARIANTS-ON default kernel + race too narrow to win live.

The fix — fix.diff (validated)

Mirrors FreeBSD's ufsdirhash_lock:

1. Adds a global static struct lock ufsdirhash_lock; (+ #include <sys/lock.h>), initialized via lockinit(&ufsdirhash_lock, "ufsdirhash", 0, 0) in ufsdirhash_init.
2. Exclusive in ufsdirhash_recycle (whole while loop, with LK_RELEASE on all three return paths — see Phase 8 note below), ufsdirhash_free (TAILQ_REMOVE), and ufsdirhash_build (INSERT_TAIL).
3. Exclusive-then-downgrade-to-shared in ufsdirhash_lookup: take exclusive for the (rare) score-reorder TAILQ mutation, re-validate dh_hash != NULL, then LK_DOWNGRADE to shared for the DH_ENTRY deref loop (so recycle/free — which need exclusive — cannot free dh_hash mid-lookup). The lock is released before every ufsdirhash_free(ip) call to avoid recursion deadlock.

git apply --check: passes. Supersedes the finding markdown's proposal (which named the lock but did not handle recycle's early-return paths — the exact bug Phase 8 caught).

Phase 8 — fix validation (MANDATORY)

• Baseline (#0, unpatched): harness UNLOCKED shows the race (53-86% UAF); harness LOCKED closes it (0%).
• First fix attempt: built clean (rc=0) but panicked at boot — panic: lockmgr: locking against itself — because ufsdirhash_recycle's two early return (-1) paths (TAILQ_FIRST==NULL, --score>0) leaked the exclusive lock; ufsdirhash_build then re-acquired exclusive at INSERT_TAIL → recursion. A diff that passes git apply --check and compiles can still be wrong. (See panic.txt.) Corrected by adding LK_RELEASE before every return path in recycle.
• Corrected fix: built clean (rc=0), installed via make installkernel, booted #1 (6.5-DEVELOPMENT #1, 06:49:30 UTC), sha256 8483fd6d3e94ce1c64bee61ac2259b2b272184652a71678851eb44aa5fd2ced2. Dir creation (40×200 entries, which deadlocked on the buggy fix) succeeded. Live dirhash trigger: 53,372,271 iterations across 8 threads, NO panic, NO deadlock, NO lockmgr errors, guest stayed up, dirhash lookups functional. Harness LOCKED mode on the patched kernel: 0% UAF (race closed).

fix_status: fixed.

PoC changes

Written from scratch under findings/poc/DF-0843/: - harness.c — deterministic race transcription with poisoned allocator + --locked mode (arg 3) that models the fix; build.sh/run.sh. - trigger.c — live multi-threaded dirhash hammer (UFS mount). - fix.diff — the validated git-apply-able fix (corrected after Phase 8).

Kernel refs (confirmed)

• sys/vfs/ufs/ufs_dirhash.c:927-970 — ufsdirhash_recycle, no lock, frees victim's dh_hash.
• sys/vfs/ufs/ufs_dirhash.c:948,951,962 — TAILQ_REMOVE + dh_hash=NULL + kfree(hash).
• sys/vfs/ufs/ufs_dirhash.c:294,318,356 — ufsdirhash_lookup unlocked dh_hash reads + DH_ENTRY double-deref.
• sys/vfs/ufs/ufs_dirhash.c:251-252 — ufsdirhash_free TAILQ_REMOVE, no global lock.
• sys/vfs/ufs/ufs_dirhash.c:221 — ufsdirhash_build INSERT_TAIL, no global lock.
• sys/vfs/ufs/dirhash.h:84-85 — DH_ENTRY macro = dh->dh_hash[slot>>8][slot&255].
• sys/vfs/ufs/ufs_dirhash.c (whole file) — zero lockmgr/mutex/spinlock calls.