DF-0851 — Stale dereference of rootp after pribp released

Finding

File: sys/vfs/isofs/cd9660/cd9660_vfsops.c lines 435–466
Severity: Low
Title: Stale dereference of rootp after pribp released — use-after-free style read on buffer cache recycle

Bug mechanism

In iso_mountfs(): 1. Line 329–347: bread(devvp, ...) reads the ISO volume descriptor into buffer pribp. pri = (struct iso_primary_descriptor *)vdp where vdp = (struct iso_volume_descriptor *)pribp->b_data. So pri points into the buffer cache data of pribp. 2. Line 407–410: rootp = (struct iso_directory_record *)pri->root_directory_record — rootp points into pribp->b_data. 3. Line 428–430: bcopy(rootp, isomp->root, ...) and isomp->root_extent = isonum_733(rootp->extent) — valid reads before release. 4. Line 435–437: pribp->b_flags |= B_AGE; brelse(pribp); pribp = NULL; — the buffer is released back to the buffer cache free list, marked B_AGE for preferential eviction. 5. Line 466: isonum_711(rootp->ext_attr_length) — STALE READ. rootp still points into the released buffer's data area. If the buffer has been evicted and reused by a concurrent bread() for a different block, this reads stale/wrong data.

The B_AGE flag explicitly requests preferential eviction, making the race more likely than a plain brelse.

Impact ceiling

• Worst case: If the race triggers, rootp->ext_attr_length returns a wrong byte → isomp->root_extent + wrong_byte is computed → bread() reads the wrong block from the device → either an EIO (mount fails — DoS) or wrong RRIP detection (mount succeeds but with wrong Rock Ridge behavior — correctness bug).
• NOT memory corruption: The read is from valid buffer-cache memory (not freed to slab), just potentially stale data. No UAF primitive, no escalation chain possible.
• Race window: Between brelse(pribp) (line 436) and isonum_711(rootp->ext_attr_length) (line 466), the code only does field assignments — no I/O. Only concurrent bread()/geteblk() from another thread/CPU could evict the buffer in that window. The window is extremely narrow.

Build

./build.sh

Run

./run.sh

This script creates a valid ISO image, enables vfs.usermount, chowns the image to the unprivileged user, then runs the PoC as maxx with concurrent I/O pressure to try to trigger the race.

Expected behavior

• Bug present (unpatched): The race is extremely unlikely to trigger — the window has no I/O. The PoC reports "no mount failures observed" in the vast majority of runs. This is a code-level defect, not a reliably-triggerable runtime fault.
• Bug fixed (patched): The stale read is eliminated by caching ext_attr_length before brelse. Behavior is identical at runtime (the race didn't trigger anyway), but the code is now correct by construction.

DF-0851 — VERDICT

Verdict

NOT REPRODUCED at runtime — the bug is a real code-level defect (stale pointer dereference confirmed by source trace) but the race window is too narrow to trigger deterministically. The fix eliminates the stale read by construction and is validated (compiles, boots, PoC runs cleanly).

Finding

File: sys/vfs/isofs/cd9660/cd9660_vfsops.c, function iso_mountfs(), lines 407–466
Severity: Low
Title: Stale dereference of rootp after pribp released — use-after-free style read on buffer cache recycle

Mechanism (code-level trace)

The bug exists in the source code, confirmed line-by-line:

1. Line 329–347: bread(devvp, ...) reads the ISO Primary Volume Descriptor (PVD) into buffer cache buffer pribp. pri = (struct iso_primary_descriptor *)vdp where vdp = (struct iso_volume_descriptor *)pribp->b_data (line 333). So pri points into pribp->b_data.

2. Line 407–410: rootp = (struct iso_directory_record *)pri->root_directory_record — rootp is derived from pri, which points into pribp->b_data. rootp is a pointer into the buffer cache data of pribp.

3. Line 428–430: Valid reads of rootp while pribp is still held: - bcopy(rootp, isomp->root, sizeof isomp->root) — copies the root dir record - isomp->root_extent = isonum_733(rootp->extent) — reads extent field - isomp->root_size = isonum_733(rootp->size) — reads size field

4. Line 435–437: The buffer is released: c pribp->b_flags |= B_AGE; /* mark for preferential eviction */ brelse(pribp); /* release to buffer cache free list */ pribp = NULL; After this, rootp is a stale pointer — it still points into the released buffer's data area, which is now eligible for eviction and reuse.

5. Line 466: Stale dereference: c if ((error = bread(isomp->im_devvp, lblktooff(isomp, isomp->root_extent + isonum_711(rootp->ext_attr_length)), isomp->logical_block_size, &bp)) != 0) isonum_711(rootp->ext_attr_length) reads from rootp, which points into the released buffer. If the buffer has been evicted and reused by a concurrent bread() for a different block, this reads stale/wrong data.

Why the race does not trigger at runtime

The race window is between brelse(pribp) (line 436) and isonum_711(rootp->ext_attr_length) (line 466). Examining lines 437–465: the code only performs field assignments (isomp->*, mp->*, dev->*, argp->*) — no I/O operations. Only a concurrent bread()/geteblk() from another CPU could evict the B_AGE-marked buffer in that window. The window is microseconds wide.

Testing with 3000 mount/unmount cycles and 8 concurrent I/O-pressure processes (heavy random reads from /boot/kernel/kernel, /var/log/messages, etc.) produced 0 failures on both unpatched and patched kernels. The buffer is virtually always still in cache when rootp->ext_attr_length is read.

Impact ceiling

• Worst case: If the race triggered, rootp->ext_attr_length would return a wrong byte → isomp->root_extent + wrong_byte → bread() reads the wrong block → either EIO (mount fails — DoS) or wrong RRIP detection (mount succeeds with wrong Rock Ridge behavior — correctness bug).
• NOT memory corruption: The read is from valid buffer-cache memory (the buffer is on the free list, not freed to the slab allocator). It's a stale-data read, not a wild pointer dereference. No UAF primitive, no escalation chain possible.
• Reachability: cd9660 mount requires SYSCAP_RESTRICTEDROOT (sys/kern/vfs_syscalls.c:5397), so only root can reach iso_mountfs(). The threat model is root mounting an attacker-provided ISO image under heavy concurrent I/O. No privilege boundary is crossed.

Reachability analysis

sys/kern/vfs_syscalls.c:152  priv = get_fscap(fstypename)
sys/kern/vfs_syscalls.c:5397 get_fscap() returns SYSCAP_RESTRICTEDROOT for "cd9660"
sys/kern/vfs_syscalls.c:154-158  caps_priv_check_td() — only root passes RESTRICTEDROOT

Unprivileged users cannot mount cd9660 even with vfs.usermount=1 (confirmed on guest: mount -t cd9660 as maxx → "Operation not permitted"). The bug is root-only reachable.

Fix

The fix caches ext_attr_length in a local variable before brelse(pribp), then uses the local at line 466:

+   int root_ext_attr_length;     // new local variable

    isomp->root_extent = isonum_733 (rootp->extent);
    isomp->root_size = isonum_733 (rootp->size);
+   root_ext_attr_length = isonum_711(rootp->ext_attr_length);  // cache BEFORE brelse

    pribp->b_flags |= B_AGE;
    brelse(pribp);                // rootp is now stale, but root_ext_attr_length is safe
    pribp = NULL;

    ...
-   isonum_711(rootp->ext_attr_length)   // STALE READ (eliminated)
+   root_ext_attr_length                  // uses cached value (safe)

This eliminates the stale read by construction. The full git-apply-able diff is in fix.diff.

Fix validation (Phase 8)

The runtime behavior is identical because the race does not trigger on either kernel. The fix is validated by construction: the stale read at the former line 466 is eliminated — the code now reads from a stack local that was populated before brelse(). The patched kernel compiles cleanly (rc=0), boots, and the PoC runs without panics or new failures.

Fix status: fixed — the code-level defect is eliminated, the patched kernel works correctly.