cuse_alloc_unit[] global arrays mutated under per-server lock instead of cuse_global_mtx
Summary
cuse_alloc_unit[64]/cuse_alloc_unit_id[64] global arrays (cuse.c:181-182) mutated by cuse_alloc_unit_by_id_locked/cuse_free_unit_by_id_locked under pcs->mtx only, not cuse_global_mtx. Distinct servers have distinct pcs->mtx -> scan-then-write race across servers -> duplicate/lost unit allocations. Root only. Fix: acquire cuse_global_lock around all alloc/free unit operations.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1405 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 888 B | ↓ raw |
DF-1405 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
cuse_alloc_unit[] global arrays mutated under per-server lock instead of cuse_global_mtx
Source Location
sys/dev/misc/cuse/cuse.c:181-711
Verdict
Source-confirmed (complex fix): cuse_alloc_unit[] global arrays mutated under per-server lock instead . No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
cuse_alloc_unit[64]/cuse_alloc_unit_id[64] global arrays (cuse.c:181-182) mutated by cuse_alloc_unit_by_id_locked/cuse_free_unit_by_id_locked under pcs->mtx only, not cuse_global_mtx. Distinct servers have distinct pcs->mtx -> scan-then-write race across servers -> duplicate/lost unit allocations. Root only. Fix: acquire cuse_global_lock around all alloc/free unit operations.
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: cuse_alloc_unit[] and cuse_alloc_unit_id[] global arrays mutated under per-server lock instead of cuse_global_mtx, cross-server race. Complex fix (lock reorder). HW-gated.
Verified recommended fix
Source-confirmed: cuse_alloc_unit[] and cuse_alloc_unit_id[] global arrays mutated under per-server lock instead of cuse_global_mtx, cross-server race. Complex fix (lock reorder). HW-gated.
Verdict
Source-confirmed: cuse_alloc_unit[] and cuse_alloc_unit_id[] global arrays mutated under per-server lock instead of cuse_global_mtx, cross-server race. Complex fix (lock reorder). HW-gated.
No comments yet.