DF-2174: __hrtimer_task epilogue unconditionally clears timer->active — UAF

Verdict: NOT REPRODUCED (HW-gated) — source-confirmed real bug

Reachability

NOT reachable on this QEMU guest. __hrtimer_task() is in sys/dev/drm/linux_hrtimer.c, part of drm.ko. HRTimers are used by DRM GPU drivers for periodic operations (radeon/amdgpu display vblank, hardware polling). Without GPU hardware, no hrtimers are started.

Mechanism (source-confirmed)

__hrtimer_task() at linux_hrtimer.c:42-69:

static void __hrtimer_task(void *arg, int pending) {
    struct hrtimer *timer = arg;
    enum hrtimer_restart restart;

    lwkt_gettoken(&timer->timer_token);
    timer->running = true;
    if (timer->cancel) { ... goto done; }
    lwkt_reltoken(&timer->timer_token);
    restart = timer->function(timer);      // callback may call hrtimer_start()
    lwkt_gettoken(&timer->timer_token);
    timer->running = false;
    timer->active = false;                 // ← BUG: unconditional clear (line 60)
    if (!timer->cancel && restart == HRTIMER_RESTART) {
        timer->active = true;              // re-set only for RESTART
        systimer_init_oneshot(...);
    }
done:
    lwkt_reltoken(&timer->timer_token);
}

The bug: if the callback calls hrtimer_start() (which sets timer->active = true at line 113 and arms a new systimer) and then returns HRTIMER_NORESTART: 1. hrtimer_start() armed a new systimer with active=true 2. Epilogue line 60: timer->active = false — clears the active flag 3. restart == HRTIMER_NORESTART → re-arm at lines 63-64 is skipped 4. Result: systimer is armed but active=false

When hrtimer_cancel() is later called (line 122-150):

if (timer->active) {   // FALSE — doesn't enter cancel path
    ...
}

It returns immediately without canceling the armed systimer. When the systimer fires, it enqueues the task again. If the struct hrtimer has been freed → use-after-free via timer->function(timer).

Primitive

• Class: UAF (timer callback from freed memory)
• The un-cancellable systimer fires after the hrtimer is freed
• On no-SMEP guest: hijacked function pointer → shellcode → uid=0

Fix

fix.diff: Set timer->active = false before the callback (the oneshot that triggered us has fired and is no longer armed), not after. The callback's hrtimer_start() correctly sets active=true and arms a new timer; the epilogue no longer clobbers it.