Summary

dmopen() looks up the dm device (incrementing ref_cnt via dm_dev_lookup) but immediately releases the reference via dm_dev_unbusy (line 213) instead of holding it for the lifetime of the open file descriptor. The is_open flag (line 212) is used as a substitute to block removal, but it is set without any lock and checked without synchronization in dm_dev_remove_ioctl (dm_ioctl.c:354). A concurrent remove can read is_open == 0 in the window between dmopen's dm_dev_lookup (line 209) and is_open = 1 (line 212), proceed to destroy the device, and free dmv while the open fd's dev->si_drv1 still points to it. Any subsequent I/O through dmstrategy (line 365), dmdump (line 474), dmsize (line 542), or disk_ioctl_switch (line 330) dereferences freed memory.

Root cause

device-mapper.c:199-217 — dmopen:

if ((dmv = dm_dev_lookup(NULL, NULL, minor(dev))) == NULL)
    return ENXIO;                 /* ref_cnt incremented, dm_dev_mutex released */

dmv->is_open = 1;                 /* plain store, no lock */
dm_dev_unbusy(dmv);               /* ref_cnt decremented back to 0 */

After dmopen returns, ref_cnt does not reflect that the device is open.

The removal path in dm_dev_remove_ioctl (dm_ioctl.c:349-361):

if ((dmv = dm_dev_lookup(name, uuid, minor)) == NULL)
    return ENOENT;
...
is_open = dmv->is_open;           /* plain read, no lock */
...
dm_dev_unbusy(dmv);

if (is_open)
    return EBUSY;
return dm_dev_remove(dmv);

The is_open read at dm_ioctl.c:354 races against dmopen's is_open = 1 store at device-mapper.c:212.

Race timeline

1. Thread A (dmopen): dm_dev_lookup → ref_cnt=1, dm_dev_mutex released
2. Thread B (remove): dm_dev_lookup → ref_cnt=2, dm_dev_mutex released
3. Thread B: reads is_open=0, dm_dev_unbusy → ref_cnt=1
4. Thread B: is_open==0 → calls dm_dev_remove
5. Thread B: dm_dev_remove acquires dm_dev_mutex, calls disable_dev
6. Thread B: disable_dev TAILQ_REMOVE, acquires dev_mtx, ref_cnt=1 != 0, cv_wait (releases dev_mtx)
7. Thread A: writes dmv->is_open = 1 (plain store)
8. Thread A: dm_dev_unbusy → acquires dev_mtx, ref_cnt=0, cv_signal, releases dev_mtx
9. Thread B: cv_wait wakes (ref_cnt==0), releases dev_mtx
10. Thread B: disable_dev returns, dm_dev_mutex released
11. Thread B: dm_dev_destroy → dm_dev_free(dmv) → kfree
12. Thread A: dmopen returns 0, dev->si_drv1 → freed dmv

The next dmstrategy call on the open fd executes dmv = dev->si_drv1 (device-mapper.c:365) on freed memory, then dereferences dmv->table_head (line 401/408), dmv->stats (line 411), etc. — a classic UAF.

The DragonFly device framework does NOT clear si_drv1 on destruction. destroy_dev (kern_conf.c:346-354) only unlinks the device from devfs and drops references; the cdev_t stays alive (held by the open fd's vnode), si_ops still points to dm_ops, and si_drv1 still points to the freed dmv. The dev_dstrategy dispatch (kern_device.c:386) has no dead-device guard.

Threat model & preconditions

• Attacker position: member of the operator group (or root). The control device /dev/mapper/control is mode 0640 root:operator (device-mapper.c:181), and dmioctl at line 241 has NO priv_check/suser — it relies entirely on device node permissions. Operator group membership is a lower privilege tier than root.
• Privileges gained or impact: kernel UAF primitive via the surviving open file descriptor. With heap grooming (spray kmalloc-512 to reclaim the freed dm_dev struct), this can be developed into arbitrary kernel memory read/write and root escalation. The floor is a reliable kernel panic / DoS.
• Required config or capabilities: device dm compiled in; access to /dev/mapper/control (operator group); ability to open the DM block device (depends on devfs rules — typically operator group for disk devices).
• Reachability: the attacker creates a DM device, then races thread A opening the block device against thread B removing it via the control device. The race window is narrow (a few instructions between dm_dev_lookup releasing dm_dev_mutex and the is_open = 1 store) but is exploitable with CPU contention and repeated attempts.

Proof of concept

PoC source: findings/poc/DF-1843/dm_uaf.c

Build & run

cc -o dm_uaf dm_uaf.c -lprop
# As a member of the operator group:
./dm_uaf

Expected output

# DoS floor:
kernel panic: freed memory dereference in dmstrategy / dm_table_size
...
dmstrategy+0x.. at 0x..
dev_dstrategy+0x.. at 0x..

# Escalation (with heap grooming):
# Spray kmalloc-512 to reclaim the freed dm_dev struct with controlled data,
# then trigger I/O through the dangling fd to hijack control flow.

Impact

High-severity kernel UAF reachable from the operator group (or root). The operator group on DragonFlyBSD grants raw disk access but not kernel code execution — this bug bridges that gap. With heap grooming the UAF can be developed into arbitrary kernel memory read/write and root escalation. The race window is narrow but winnable with CPU contention and repeated attempts.

Recommended fix

Hold the busy reference for the lifetime of the open, releasing it in dmclose. This makes disable_dev's ref_cnt == 0 wait block until dmclose, preventing the UAF entirely.

--- a/sys/dev/disk/dm/device-mapper.c
+++ b/sys/dev/disk/dm/device-mapper.c
@@ -203,6 +203,7 @@ dmopen(struct dev_open_args *ap)
    if (minor(dev) == 0)
        return 0;

+   /* Hold the busy reference for the lifetime of the open. */
    if ((dmv = dm_dev_lookup(NULL, NULL, minor(dev))) == NULL)
        return ENXIO;

@@ -210,7 +211,6 @@ dmopen(struct dev_open_args *ap)
    dmv->is_open = 1;
-   dm_dev_unbusy(dmv);

    dmdebug("minor=%" PRIu32 "\n", minor(ap->a_head.a_dev));
    return 0;
@@ -224,11 +224,16 @@ dmclose(struct dev_close_args *ap)

    /* Shortcut for the control device */
    if (minor(dev) == 0)
        return 0;
+
+   /*
+    * Use si_drv1 directly: the device may have already been
+    * removed from the global list, so dm_dev_lookup would fail.
+    * The reference we held from dmopen keeps dmv alive.
+    */
+   dmv = dev->si_drv1;
+   if (dmv == NULL)
+       return ENXIO;

-   if ((dmv = dm_dev_lookup(NULL, NULL, minor(dev))) == NULL)
-       return ENXIO;
-
    dmv->is_open = 0;
    dm_dev_unbusy(dmv);
+
    dmdebug("minor=%" PRIu32 "\n", minor(ap->a_head.a_dev));
    return 0;
 }

With this fix, disable_dev's while (dmv->ref_cnt != 0) cv_wait(...) in dm_dev.c:74-75 blocks until dmclose drops the last reference, so dm_dev_remove/dm_dev_destroy cannot proceed while any fd is open. The is_open flag becomes redundant for safety but is retained as a fast-path hint. dmclose must use dev->si_drv1 directly (not dm_dev_lookup) because the device may already be removed from the list when the last close happens.

References

• disable_dev ref_cnt wait: dm_dev.c:66-78.
• dm_dev_unbusy ref_cnt decrement: dm_dev.c:398-404.
• dm_dev_remove → disable_dev → dm_dev_destroy → dm_dev_free: dm_dev.c:305-316, 272-299.
• Missing si_drv1 clear on destroy: kern_conf.c:346-354.

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).