DF-0917 — Use-after-free on fuse_ipc during tx completion

Use-after-free on fuse_ipc (fip) in the FUSE IPC transaction-completion path. The /dev/fuse read/write completion handlers remove fip from the reply/request TAILQ under ipc_lock, drop the lock, and then dereference fip (fip->reply, fip->request.buf, fip->done) with no reference held. If the tx originator (blocked in fuse_ipc_wait) times out (~35s), fuse_ipc_tx:270 fuse_ipc_put(fip) drops the last ref and frees fip while the device path is still mid-access → UAF (16-byte fuse_buf write + pointer read + 4-byte atomic into a freed slab slot).

• Severity: High (memory corruption; root→kernel on default GENERIC).
• Impact: panic / corruption (DoS) when the race is won.
• Reachability: root-only on default GENERIC (/dev/fuse root:operator 0660, mount("fuse") needs uid==0). Same root-only-FUSE threat model as DF-0915. NOT an unprivileged→root escalation.
• Files: sys/vfs/fuse/fuse_device.c:118-223 (the bug), sys/vfs/fuse/fuse_ipc.c:112-271 (the ref/free mechanics).

Files in this evidence pack

Reproduce

# unprivileged deterministic proof (primary):
ssh dfbsd-maxx 'cd poc/DF-0917 && sh build.sh && ./harness && ./harness_fixed'
#   ./harness        -> "UAF CONFIRMED"
#   ./harness_fixed  -> "NO UAF (ref held across window)"

# live race attempt on the real kernel (root only, each iter ~35s):
ssh dfbsd 'kldload fuse && mkdir -p /mnt/fuse && cd /home/maxx/poc/DF-0917 && ./fused0917 2'

# build + install the fix (module-only), then re-test:
ssh dfbsd 'cd /usr/src && patch -p1 < /root/fix.diff && cd sys/vfs/fuse && make && cp /usr/obj/usr/src/sys/vfs/fuse/fuse.ko /boot/kernel/fuse.ko && kldload fuse'

Expected results

• UNFIXED #0 kernel + harness: UAF CONFIRMED (deterministic).
• UNFIXED #0 kernel + fused0917: stat()=ETIMEDOUT (tx waiter freed fip), daemon write()=ENOMSG (fip already removed); guest stays up (the sub-µs race is not won in a bounded run — see VERDICT.md).
• Patched fuse.ko + harness_fixed: NO UAF.
• Patched fuse.ko + fused0917: identical to unpatched (no regression; FUSE mounts/stats/replies correctly; guest stays up).

DF-0917 — Use-after-free on fuse_ipc during tx completion

Verdict: REPRODUCED (UAF pattern confirmed by deterministic harness + line-by-line code-path trace); fix VALIDATED (patched fuse.ko compiles clean, loads, FUSE subsystem functions with no regression; model-level before/after proves the refcount-hold closes the window).

Impact on default GENERIC (#0, INVARIANTS ON): panic / memory corruption (DoS) when the race is won — a 16-byte write (struct fuse_buf = kernel pointer + length) into a freed fuse_ipc slab slot plus a pointer dereference (fuse_in(fip) reads the freed request.buf) and a 4-byte atomic on fip->done. Reachability is root-only on default config (/dev/fuse is root:operator 0660, mount("fuse") needs caps_priv_check( SYSCAP_NOMOUNT_FUSE) → uid==0), so this is a root→kernel UAF, not an unprivileged→root escalation (same hard blocker as DF-0915).

The bug (line-by-line)

The daemon's /dev/fuse write completion (sys/vfs/fuse/fuse_device.c, fuse_device_write) and read completion (fuse_device_read) both:

1. take ipc_lock, find fip in reply_head/request_head, TAILQ_REMOVE it, and release ipc_lock — fuse_device.c:197 (write), fuse_device.c:149 (read);
2. then dereference fip with no reference held: - write path: fip->reply = fb (:205), fuse_in(fip) = fip->request.buf (:206), fuse_ipc_test_and_set_replied(fip) = atomic on fip->done (:219); - read path: fuse_in_size(fip) = fip->request.len (:153), fuse_in(fip) (:156), fip->sent atomic (:158).

The only reference on fip is the originator's (fuse_ipc_get sets refcnt=1, fuse_ipc.c:98; nobody else refcount_acquires). The originator blocks in fuse_ipc_wait (fuse_ipc.c:158). On timeout (7 × 5*hz = ~35s, fuse_ipc.c:175,183) the waiter runs fuse_ipc_remove + fuse_ipc_set_replied (:186-187) and returns ETIMEDOUT (:188); fuse_ipc_tx then calls fuse_ipc_put(fip) (:270) which drops refcnt 1→0 and frees fip (fuse_buf_free ×2 + objcache_put, fuse_ipc.c:112-116). If that free lands while the device path is still mid-access (between its mtx_unlock and its last fip deref), every one of those derefs is a use-after-free.

The freeing path is real and was exercised live: a daemon that delays its FUSE_GETATTR reply by 35s causes the originator's stat() to return ETIMEDOUT (so fuse_ipc_put ran and freed fip), and the daemon's subsequent write() for that unique returns ENOMSG/w=-1 (fip already removed from reply_head by the timed-out waiter's fuse_ipc_remove). The UAF arm — daemon finds fip in reply_head and then the waiter frees it before :205 — is the same code path with the waiter losing the lock race by a few microseconds rather than winning it.

Why the live race is hard (and why a deterministic harness is the proof)

The UAF requires the originator's final 5*hz tsleep to return EWOULDBLOCK at the precise instant the daemon's write() syscall holds fip between lock-drop (:197) and set_replied (:219) — a sub-microsecond window against a 35-second period. The per-attempt hit probability is ~window/period ≈ 1µs/35s ≈ 3×10⁻⁸; winning it live needs many thousands of 35-second attempts (hours). This is exactly the "live race too narrow → deterministic code-level harness reproducing the drop-lock-then-access-fip logic" case (option (b) in the playbook).

harness.c models both paths with pthreads and forces the worst interleaving with two barriers placed at the kernel's lock-drop point: - UNFIXED build → UAF CONFIRMED: the device thread observes the 0xdeadc0de poison the timeout/free thread wrote into the freed fip (mirrors INVARIANTS WEIRD_ADDR slab poisoning), proving it dereferenced freed memory. Deterministic across 3/3 runs. - -DFIXED build → NO UAF: the device thread's refcount_acquire (mirroring the fix) makes refcnt=2, so the waiter's put (2→1) cannot free fip mid-access. Deterministic across 3/3 runs.

Threat model / reachability / Phase 6 escalation

• /dev/fuse is crw-rw---- root:operator; mount("fuse",...) requires caps_priv_check(SYSCAP_NOMOUNT_FUSE) → uid==0 (fuse_vfsops.c:155, kern_caps.c:311). vfs.usermount=0 on this guest and maxx (uid 1001) is not in operator. So the FUSE daemon — which authors the timing that opens the race — must be started by root on default GENERIC.
• This is a root→kernel UAF (hardening gap + DoS) on default config. It is not an unprivileged→root escalation: the valid hard blocker "the write is reachable only from an already-root context" applies (the daemon that opens the race window runs as root; root→kernel is game-over by definition; there is no privilege boundary for the daemon to cross for itself). An unprivileged consumer (maxx) can drive a stat()/read() on a root-mounted FUSE fs, but maxx cannot shape the race timing or the freed-slot content, so he cannot escalate himself.
• Conditional escalation (NOT default config): IF an admin set vfs.usermount=1 AND added the user to operator, an unprivileged user could run the daemon, win the race, and reclaim the freed fuse_ipc slot with controlled content. fuse_ipc is a dedicated objcache (M_FUSE_IPC, fuse_ipc.c:34,316-318) backed by kmalloc; on GENERIC the WEIRD_ADDR/chunk_mark_* INVARIANTS checks in kern_slaballoc.c would very likely catch the cross-free corruption and panic before a clean uid0. On a non-default INVARIANTS-OFF build the primitive (16-byte controlled write of a fuse_buf into the recycled slot + a ptr read + 4-byte atomic) would be directly weaponizable against a same-bucket victim (e.g. another fuse_ipc, or a kmalloc-same-size object holding a function pointer / ucred *). These are documented as conditional / non-default, not default-GENERIC.

Outcome: primitive fully characterized (16-byte write + ptr-read + 4-byte atomic UAF into a freed fuse_ipc slab slot); escalation on default GENERIC blocked by the root-only-FUSE hard blocker (root authors the race; no unpriv boundary to cross). Impact on default GENERIC = panic / corruption (DoS) from a root-started (or conditionally-unprivileged) malicious/slow daemon.

The fix (fix.diff)

Hold a reference on fip across the lock-drop window in both fuse_device_write and fuse_device_read: refcount_acquire(&fip->refcnt) under ipc_lock (before the unlock), and fuse_ipc_put(fip) after the last fip access. Four hunks:

• fuse_device.c:149 — read path: acquire after TAILQ_REMOVE from request_head;
• fuse_device.c:162 — read path: fuse_ipc_put(fip) before return error;
• fuse_device.c:196 — write path: acquire after TAILQ_REMOVE from reply_head;
• fuse_device.c:225 — write path: fuse_ipc_put(fip) before return error.

The early return ENOMSG (write, fip==NULL) and the read-path mtxsleep-error returns sit before any ref/acccess, so they need no put. With the fix, the originator's timeout fuse_ipc_put drops refcnt 2→1 (not 1→0), so fip cannot be freed while the device path still dereferences it; the device path's own final fuse_ipc_put then performs the last drop. This matches the finding's recommended fix ("refcount_acquire under ipc_lock before unlock").

Fix validation (Phase 8)

• Applies clean: patch -p1 --forward < fix.diff → all 4 hunks at :146/:159/:193/:222.
• Builds clean: module-only cd /usr/src/sys/vfs/fuse && make → fuse.ko produced, -Werror, no warnings (fix_build.log).
• Loads clean: kldload fuse → RC=0, /dev/fuse appears (sha256 fuse.ko = 2eff54d3…).
• No regression (live): on the patched module, fused0917 2 mounts FUSE, handles INIT/STATFS/LOOKUP/GETATTR/OPEN, the delayed GETATTRs time out (stat()=ETIMEDOUT, daemon write()=ENOMSG) exactly as on the unpatched module, and the guest stays up (fix_run.log). The fix changes nothing observable when the race is not won — it only closes the UAF window — so identical live behavior before/after is the correct expectation.
• Model-level before/after: harness (UNFIXED) → UAF CONFIRMED; harness_fixed (-DFIXED) → NO UAF (ref held across window). Proves the refcount-hold closes the window deterministically.

fix_status = fixed: the patched fuse.ko compiles, loads, and the FUSE subsystem functions correctly; the model-level before/after demonstrates the window is closed.

How to reproduce

# unprivileged deterministic models (the primary proof):
ssh dfbsd-maxx 'cd poc/DF-0917 && sh build.sh && ./harness && ./harness_fixed'
# live race attempt on the real kernel (root only):
ssh dfbsd 'kldload fuse && mkdir -p /mnt/fuse && cd /home/maxx/poc/DF-0917 && ./fused0917 2'
# fix build + install + re-test (module-only):
ssh dfbsd 'cd /usr/src && patch -p1 < /root/fix.diff && cd sys/vfs/fuse && make && cp /usr/obj/usr/src/sys/vfs/fuse/fuse.ko /boot/kernel/fuse.ko && kldload fuse'