• File: sys/dev/disk/dm/delay/dm_target_delay.c
• Lines: 104–156 (init), 362–380 (worker loop), 281–301 (_submit_queue)
• Severity: Medium
• CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
• CWE: CWE-416 Use After Free, CWE-824 Access of Uninitialized Pointer
• Confidence: certain
• Status: new

Summary

dm_target_delay_init starts a kernel worker thread (lwkt_create(_thread, di, …), line 152) inside _init for the read side. If the subsequent write-side _init fails — e.g. the write device path does not exist (dm_pdev_insert returns NULL at line 136) — the error path only does dm_pdev_decr(tdc->read.pdev) + kfree(tdc, M_DMDELAY) (lines 114–117). The read worker thread is never told to exit; it is left tsleeping on the address of di inside the just-freed tdc.

Any later wakeup colliding with that address, or a slab-reallocation that re-populates the freed vaddr, causes the thread to wake, re-acquire a corrupted lwkt_token, read di->enabled / di->buf_mtx / di->buf_list from reallocated memory, and call _submit_queue on a corrupted TAILQ head. The TAILQ_REMOVE in _submit_queue (line 284) then performs a write through a controlled dp pointer, producing a kernel panic or, with slab grooming, a corrupted-list-driven arbitrary-write primitive.

dm_table_destroy's later call to dm_target_delay_destroy is a no-op because target_config was never set (init failed before dm_table_init_target, line 123), so it cannot recover the leaked thread either.

Root cause

_init (lines 128–156) is monolithic: it calls dm_pdev_insert(argv[0]) (which can fail and return NULL → ENOENT, line 136), and only on success does it run callout_init, mtx_init, lwkt_token_init, set di->enabled=1, and lwkt_create(_thread, di, …) (lines 145–152). lwkt_create cannot fail (lwkt_thread.c:1648-1676 always returns 0), so once _init for read returns 0 the worker thread is live and referencing di = &tdc->read.

dm_target_delay_init then calls _init(&tdc->write, argv, 1) (line 113). If write's _init fails (e.g. dm_pdev_insert on a non-existent path returns NULL at line 136), the cleanup is only:

dm_pdev_decr(tdc->read.pdev);
kfree(tdc, M_DMDELAY);
return ret;

(lines 114–118). There is no _destroy(&tdc->read) to cancel the callout, drain the buf_list, set read.enabled=0, wakeup the thread, and wait for it to exit. The thread at lines 362–380 is still inside while (di->enabled) { tsleep(di, …); _submit_queue(di, 0); }.

After kfree, di is freed memory. On any wakeup to that ident (DragonFly wakeup hashes the ident address; an address collision from a future sleeper at the same vaddr, or the same callout firing, will do), the thread re-acquires &di->token (corrupted), evaluates di->enabled (reallocation contents), and on non-zero enters _submit_queue which walks di->buf_list under di->buf_mtx — all corrupted. TAILQ_REMOVE in _submit_queue line 284 then performs a write through a controlled dp pointer.

The argc==6 case is worse: write's _init failing on a different device than read means dm_pdev_decr(read.pdev) may free the read pdev (ref_cnt 1→0) at the same moment, so the orphaned thread also holds a dangling di->pdev used by _submit (line 267) → vn_strategy on a freed vnode.

Threat model

Attacker position: any principal able to issue DM_TABLE_CMD_LOAD to /dev/mapper/control (default 0640 root:operator — so root, or any operator-group principal such as a half-trusted storage admin / container with operator privileges).

Trigger: a dmsetup create table load whose read device exists but whose write device does not, e.g. 0 <len> delay /dev/valid 0 100 /dev/does-not-exist 0 200.

Impact: kernel memory corruption — best case deterministic panic on the next wakeup colliding with the freed ident, worst case an attacker who grooms the freed M_DMDELAY slab (size ~96 bytes — fits many common kernel allocations) and times a wakeup can drive the corrupted TAILQ_REMOVE in _submit_queue into an arbitrary kernel write, or vn_strategy a controlled bio into a victim device. Even without exploitation this is a guaranteed kernel-memory-corruption state after the trigger: a live thread holds references exclusively to freed memory.

Proof of concept

Setup (root or operator): trigger the failed write-side _init so the read worker is orphaned

#!/bin/sh
# poc_df_1964_setup.sh
set -e
# /dev/ad0 must exist (any block device the operator can name);
# /dev/nope must NOT resolve to an openable block device.
REAL=/dev/ad0
BOGUS=/dev/nope
SIZE=$(diskinfo -v "$REAL" | awk '/bytes/ {print $1}')
SEC=$(( SIZE / 512 ))
# 6-arg delay: read side uses a real device (init succeeds, thread starts),
# write side uses a bogus device (init fails, tdc is freed, thread orphaned).
dmsetup create vuln-delay --table "0 $SEC delay $REAL 0 100 $BOGUS 0 200" || true
# The create fails (write side ENOENT) — that is the bug: the read worker
# is now running against freed tdc.

Force the UAF to land

The simplest reliable trigger is to churn M_DMDELAY-sized allocations until the freed tdc vaddr is reused, then provoke a wakeup colliding with the orphaned thread's tsleep ident:

/* poc_df_1964_groom.c  (build: cc -o groom groom.c)
 * Repeatedly create+destroy throwaway dm-delay tables (3-arg form, both
 * sides resolve) to churn kmalloc(M_DMDELAY)/kfree and cause the orphaned
 * thread's `di` vaddr to be reallocated with new contents. Each destroy
 * path also issues wakeups through the dm ioctl layer whose idents hash
 * near the orphaned thread's ident, provoking spurious wakeups. After a
 * few hundred iterations the orphaned thread either panics in
 * _submit_queue on a corrupted buf_list, or in mtx_lock(&di->buf_mtx)
 * on a corrupted mtx.
 */
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <dev/disk/dm/netbsd-dm.h>
int main(void){
    /* loop dmsetup create+remove of 3-arg delay tables */
    for(;;){ /* ... */ }
}

Success criterion: kernel panic in _thread / _submit_queue / mtx_lock shortly after the setup step, with a backtrace rooted at lwkt_switch → _thread. Without grooming: the system is left with a thread holding a dangling reference — a guaranteed latent panic that any future address-collision wakeup will fire, so even a non-root user later issuing unrelated dm ioctls can be the one to trip it.

Recommended fix

When write's _init fails, fully tear down the read side via the existing _destroy() (which cancels the callout, drains the buf_list, sets enabled=0, wakes the thread, waits for it to exit, uninits the mutexes, and decrements the pdev). Do not call dm_pdev_decr by hand — _destroy already does it.

--- a/sys/dev/disk/dm/delay/dm_target_delay.c
+++ b/sys/dev/disk/dm/delay/dm_target_delay.c
@@ -111,10 +111,11 @@ dm_target_delay_init(dm_table_entry_t *table_en, int argc, char **argv)

    ret = _init(&tdc->write, argv, 1);
    if (ret) {
-       dm_pdev_decr(tdc->read.pdev);
+       /* Fully tear down the read side: stop its worker thread, drain
+        * its delayed bios, and drop the pdev reference. _destroy()
+        * already calls dm_pdev_decr(di->pdev). */
+       _destroy(&tdc->read);
        kfree(tdc, M_DMDELAY);
        return ret;
    }

The symmetric fix in the first error path (read _init failure at line 105) is already correct: no thread has been started yet, so plain kfree suffices.

References

• sys/dev/disk/dm/delay/dm_target_delay.c:104-118 — the buggy error path
• sys/dev/disk/dm/delay/dm_target_delay.c:128-156 — _init starts the worker
• sys/dev/disk/dm/delay/dm_target_delay.c:362-380 — the orphaned worker loop
• sys/dev/disk/dm/delay/dm_target_delay.c:281-301 — _submit_queue walks the corrupted list (TAILQ_REMOVE at line 284)
• sys/kern/lwkt_thread.c:1648-1676 — lwkt_create cannot fail, so the read thread is always live when read _init returns 0