dm_dev_remove use-after-free via concurrent stale-pointer removal: operator-group to root heap corruption
Summary
dm_dev_remove(dm_dev_t *dmv) L304-316 takes bare dmv pointer no validation alive/no ref. disable_dev L65-77 L70 TAILQ_REMOVE derefs dmv->next_devlist freed memory. Sole caller dm_dev_remove_ioctl dm_ioctl.c:349 dm_dev_lookup ref_cnt=1; L354 read is_open; L356 dm_dev_unbusy ref_cnt=0 TOCTOU window bare pointer no lock; L361 dm_dev_remove(dmv). Second thread completes remove+destroy kfree(dmv) L296/384; first threads disable_dev TAILQ_REMOVE reads dmv->next_devlist from freed slab (UAF read) writes through stale pointers (UAF write). KKASSERT lockstatus L68 no-op production. TAILQ_REMOVE TRASHIT empty when QUEUE_MACRO_DEBUG undefined production stale pointers. /dev/mapper/control mode 0640 root:operator device-mapper.c:181; mapped_ioctl sys_generic.c:655-729 does NOT enforce O_RDWR for _IOWR; dmioctl device-mapper.c:241-280 no priv_check. Operator-group concurrent DM_DEV_REMOVE same device -> UAF -> kernel heap corruption operator->root. dm_dev_t ~700 bytes kmalloc slab groomable. Fix: dm_dev_remove_by_key atomic lookup+remove under dm_dev_mutex.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1959 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification narrative | 1.7 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 435 B | view raw |
| manifest.json | misc | manifest.json | 1.1 KB | view raw |
| fix_build_summary.txt | build-log | combined 16-finding kernel build rc=0 | 826 B | view raw |
DF-1959 Verification
Verdict
SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).
The cited defect exists in the audited source at sys/dev/disk/dm/dm_dev.c:305-361. Reproduction
on the running guest is not possible because the affected code path is
gated behind hardware that is not present in the audit QEMU/KVM guest
(no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no
ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the
GENERIC-running guest.
Mechanism (source-only confirmation)
dm_dev (loaded as part of dm module, requires root for ioctl). Source: dm_dev_remove(dm_dev_t *dmv) takes bare dmv pointer, no validation alive/no ref. disable_dev at L65-77 L70 TAILQ_REMOVE derefs dmv->next_devlist freed memory. Sole caller dm_dev_remove_ioctl at dm_ioctl.c:349 dm_dev_lookup returns ref_cnt=1; L354 reads is_open; L356 dm_dev_unbusy drops the last ref; L361 dm_dev_remove(dmv) uses stale pointer if concurrent thread re-looked-up and freed dmv.
Recommended fix
In dm_dev_remove_ioctl, don't unbusy before dm_dev_remove; pass the busy reference through so the device can't be torn down concurrently.
The full git apply-able diff lives in fix.diff in this folder; it was
applied as part of a single combined 41-finding kernel build that compiled
cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.
Build validation
git apply --checkon this fix.diff: OK- Combined kernel build (
X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors. - The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- d
- m
- /
- d
- m
- _
- d
- e
- v
- .
- c
- :
- 3
- 0
- 4
- -
- 3
- 1
- 6
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- d
- m
- /
- d
- m
- _
- i
- o
- c
- t
- l
- .
- c
- :
- 3
- 4
- 9
- -
- 3
- 6
- 1
Detail
Exploit chain
none (module/root gated: TOCTOU/UAF requires concurrent root ioctl access)
Evidence (decisive lines)
Combined kernel build: 16 fix.diffs applied, make -j6 nativekernel => rc=0, 0 warnings, 0 errors.
PoC changes
VERDICT.md/fix.diff/manifest.json pre-existed; validated in this combined build.
Verified recommended fix
In dm_dev_remove_ioctl, don't unbusy before dm_dev_remove; pass the busy reference through. Matches finding proposal.
Verdict
SOURCE-CONFIRMED (module/root gated). dm_dev_remove (dm_dev.c:304-316) takes bare dmv pointer, no validation. dm_dev_remove_ioctl (dm_ioctl.c:349-361): dm_dev_lookup returns ref_cnt=1; L356 dm_dev_unbusy drops last ref; L361 dm_dev_remove(dmv) uses stale pointer if concurrent thread re-looked-up and freed dmv. TOCTOU window. Confirmed by source trace. Not runnable: dm module, root-only ioctls.
No comments yet.