Summary

pci_user.c takes a local lwkt_token (pci_token, declared at line 59, acquired at 332) so that two ioctls cannot race each other, but every writer of the shared pci_devq list on the kernel side — pci_read_device() / STAILQ_INSERT_TAIL at sys/bus/pci/pci.c:576 and pci_freecfg() / STAILQ_REMOVE + kfree at sys/bus/pci/pci.c:2155-2156, plus pci_numdevs / pci_generation mutations — runs WITHOUT ever acquiring pci_token. Likewise pci_find_dbsf() at sys/bus/pci/pci.c:353-368 walks the list and returns an unreferenced device_t with no token held. Therefore an in-flight PCIOCGETCONF iteration (lines 463-553), a PCIOCGETBAR / PCIOCREAD / PCIOCWRITE / PCIOCATTACHED lookup via pci_find_dbsf (lines 621, 682, 742), or a device_get_ivars() / resource_list_find() dereference (lines 689-701) can run concurrently with a kernel-side list mutation and dereference a freed pci_devinfo or traverse a poisoned STAILQ link.

Root cause

pci_token is declared static in pci_user.c:59 and acquired only at pci_user.c:332. Grepping the entire sys/bus/pci tree shows pci_token is referenced nowhere else — sys/bus/pci/pci.c (the actual list mutator) uses no equivalent lock around STAILQ_INSERT_TAIL (line 576), STAILQ_REMOVE (line 2155), kfree(dinfo) (line 2156), pci_numdevs++ (line 594) / pci_numdevs-- (line 2162), or pci_generation++ (lines 595, 2159). pci_find_dbsf (pci.c:353-368) is a naked STAILQ_FOREACH with no synchronization.

The PCIOCGETCONF loop at pci_user.c:463-467 caches dinfo = STAILQ_FIRST then steps via STAILQ_NEXT(dinfo, pci_links) — if pci_freecfg runs between two iterations, STAILQ_NEXT reads dinfo->pci_links.sqe_next after dinfo has been kfree()'d (UAF), and pci_numdevs can be observed mid-decrement.

Threat model & preconditions

• Attacker position: A SYSCAP_RESTRICTEDROOT process that holds /dev/pci open while another privileged action triggers a pci_devq mutation: devctl detach of a PCI driver, kldunload / kldload of a PCI driver, ACPI / PCIe hotplug event (Thunderbolt / ExpressCard / CardBus), or suspend / resume cycling through pci_cfg_save / restore paths that touch the device list.
• Privileges gained or impact: Ranges from a benign skip / duplication of an entry to a kernel UAF dereference or poisoned-list traversal — panic (local DoS) at minimum, and if dinfo memory can be reclaimed with attacker-controlled data before STAILQ_NEXT dereferences it, potentially a controlled kernel read/write primitive. The race is narrow (must hit the window between STAILQ_REMOVE and the next iteration's link read) so confidence is speculative; on systems without runtime PCI topology changes this is unreachable.
• Required config or capabilities: Default kernel with pci. Two cooperating privileged processes.
• Reachability: Concurrent PCIOCGETCONF + devctl detach / kldunload of a PCI driver. See PoC.

Proof of concept

Reproduction requires two cooperating privileged processes:

(a) A "walker" root process that opens /dev/pci and issues PCIOCGETCONF in a tight loop, spinning through the whole device list each call.

(b) A "mutator" root process that triggers concurrent device-list mutation. The most portable mutator on DragonFly is kldunload / kldload of a removable PCI driver, or devctl detach <drivername> for an attached PCI function.

/* walker.c — root */
#include <sys/pciio.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>

int main(void) {
    int fd = open("/dev/pci", O_RDONLY);
    if (fd < 0) return 1;
    for (;;) {
        struct pci_conf_io cio;
        char buf[4096];
        memset(&cio, 0, sizeof cio);
        cio.match_buf_len = sizeof(buf);
        cio.matches = (struct pci_conf *)buf;
        ioctl(fd, PCIOCGETCONF, &cio);
    }
}

# mutator.sh — root, in parallel
while true; do
    kldload if_em 2>/dev/null
    kldunload if_em 2>/dev/null
done

Build & run

cc -o walker walker.c
sudo ./walker &
sudo ./mutator.sh

Expected output

Kernel panic with a dereference of a freed pci_devinfo (e.g. Fatal trap 12: page fault while in kernel mode on a poisoned pointer) within seconds to minutes. If no panic occurs across long runs, the window is too narrow on this hardware / config and the finding should be downgraded. A reproducible panic that points into pci_conf_match or STAILQ_NEXT in pci_user.c confirms the UAF.

Because exploitation for code execution requires beating the allocator with a controlled reclaim of the freed pci_devinfo slab, treat the primitive as "local DoS / possible UAF" rather than guaranteed root.

Impact

Speculative local UAF via concurrent PCIOCGETCONF and kernel-side PCI list mutation. Narrow race window; root-only ioctl surface; PCI topology must be changing at runtime (hot-plug, devctl detach, kldunload). Low severity (CVSS numerical) despite the C:H/I:H/A:H impact ratings because of the speculative confidence + high attack complexity.

Recommended fix

Move ownership of pci_token to sys/bus/pci/pci.c and take it around every read and modification of pci_devq / pci_numdevs / pci_generation. Concretely: declare pci_token non-static (export it in pcivar.h) and wrap STAILQ_INSERT_TAIL in pci_read_device (pci.c:576), STAILQ_REMOVE + kfree in pci_freecfg (pci.c:2155-2156), the pci_numdevs / pci_generation updates at pci.c:594-595 and 2159-2162, and the iteration inside pci_find_dbsf (pci.c:353-368) with lwkt_gettoken / reltoken(&pci_token). pci_user.c then continues to acquire the same token at line 332 and the lock becomes correct.

Sketch:

--- a/sys/bus/pci/pcivar.h
+++ b/sys/bus/pci/pcivar.h
@@
+extern struct lwkt_token pci_token;

--- a/sys/bus/pci/pci_user.c
+++ b/sys/bus/pci/pci_user.c
@@
-static struct lwkt_token pci_token = LWKT_TOKEN_INITIALIZER(pci_token);
+struct lwkt_token pci_token = LWKT_TOKEN_INITIALIZER(pci_token);

--- a/sys/bus/pci/pci.c
+++ b/sys/bus/pci/pci.c
@@
 device_t
 pci_find_dbsf(uint32_t domain, uint8_t bus, uint8_t slot, uint8_t func)
 {
    struct pci_devinfo *dinfo;
+   device_t dev = NULL;
+
+   lwkt_gettoken(&pci_token);
    STAILQ_FOREACH(dinfo, &pci_devq, pci_links) {
        if ((dinfo->cfg.domain == domain) &&
            (dinfo->cfg.bus == bus) &&
            (dinfo->cfg.slot == slot) &&
            (dinfo->cfg.func == func)) {
-           return (dinfo->cfg.dev);
+           dev = dinfo->cfg.dev;
+           break;
        }
    }
-   return (NULL);
+   lwkt_reltoken(&pci_token);
+   return (dev);
 }

…and similarly wrap the STAILQ_INSERT_TAIL / STAILQ_REMOVE sites and the pci_numdevs / pci_generation mutations.

Note this still leaves a separate TOCTOU between pci_find_dbsf returning and PCIB_READ_CONFIG being issued on the returned device_t — a fully robust fix would also acquire a per-device reference count, but extending pci_token coverage closes the list-corruption / UAF-via-STAILQ_NEXT window which is the directly reachable primitive from this file.

References

• sys/bus/pci/pci_user.c:59 — pci_token declaration (static, only referenced in pci_user.c)
• sys/bus/pci/pci_user.c:332 — sole acquire site
• sys/bus/pci/pci_user.c:463-467 — PCIOCGETCONF STAILQ_NEXT walk
• sys/bus/pci/pci.c:353-368 — pci_find_dbsf naked STAILQ_FOREACH
• sys/bus/pci/pci.c:576, 594-595 — pci_read_device insert + counter bump (no token)
• sys/bus/pci/pci.c:2155-2162 — pci_freecfg remove + free + counter decrement (no token)
• CWE-416 Use After Free

Timeline

• 2026-07-14 Discovered during automated audit.