DF-2229 — prop_array_iterator and 3 siblings lack prop_object_is_array guard → NULL deref panic

Verdict

REPRODUCED — local kernel NULL-deref panic; fix validated on a rebuilt kernel. Four public accessors in prop_array.c — prop_array_iterator, prop_array_make_immutable, prop_array_mutable, prop_array_externalize — dereference pa->pa_rwlock (or pa->pa_obj.po_type) with no prop_object_is_array(pa) type guard, unlike every other public accessor in the file (prop_array_capacity/count/ensure_capacity/get/set/add/remove/equals all guard). Passing NULL (or a non-array object) derefs near-NULL → panic. The reachable trigger is the device-mapper reload ioctl: dm_table_load_ioctl (dm_ioctl.c:707-708) feeds the unchecked return of prop_dictionary_get(dm_dict, "cmd_data") straight into prop_array_iterator; omitting cmd_data from the attacker-controlled plist yields NULL → panic, before any device-lookup check.

Mechanism (trigger → primitive → effect)

// sys/libprop/prop_array.c:538-545  (prop_array_iterator)
prop_object_iterator_t
prop_array_iterator(prop_array_t pa)
{
        prop_object_iterator_t pi;
        _PROP_RWLOCK_RDLOCK(pa->pa_rwlock);   // NO guard; pa=NULL -> mtx_lock
        ...
}

• Kernel rwlock macro _PROP_RWLOCK_RDLOCK(x) = mtx_lock(&(x)) (prop_object_impl.h:297); with pa=NULL this is mtx_lock(&pa->pa_rwlock) at offset 0x40 from NULL → write page-fault → panic.
• Trigger path: dmioctl (device-mapper.c:241) → NETBSD_DM_IOCTL → prop_dictionary_copyin_ioctl (parses attacker plist) → dm_check_version (needs version=[4,<=16,*]) → dm_cmd_to_fun ("reload") → dm_table_load_ioctl (dm_ioctl.c:673): c cmd_array = prop_dictionary_get(dm_dict, DM_IOCTL_CMD_DATA); // NULL if absent iter = prop_array_iterator(cmd_array); // line 708 -> panic // (device-lookup check is at line 711, AFTER this deref)

Evidence (panic, unpatched #0)

Fatal trap 12: page fault while in kernel mode
cpuid = 4
fault virtual address  = 0x40
fault code             = supervisor write data, page not present
Stopped at      prop_array_iterator+0x1b:   lock cmpxchgl %edx,0x40(%rdi)
db>

Reproduced on 2 independent fresh vm.sh reset with-src runs (deterministic). 0x40 is exactly the pa_rwlock offset from the NULL pa; the faulting cmpxchgl is the mtx_lock inside _PROP_RWLOCK_RDLOCK. See panic.txt.

Threat model / privilege boundary

• /dev/mapper/control is created when the dm module is loaded and is 0640 root:operator (confirmed in-guest). So a local user in the operator group (and root trivially) can issue the ioctl and panic the kernel. The dm module is not loaded by default GENERIC but is standard on any system using LVM2/device-mapper. Impact: immediate local kernel panic / DoS. The plist is attacker-controlled (prop_dictionary_copyin_ioctl parses it), so omitting cmd_data is trivial.
• Severity Medium / confidence certain (deterministic panic, reachable from an operator-group user once dm is available).

PoC changes

• df2229.c (new): builds {command="reload", version=[4,16,0], name=..., flags=0} with NO cmd_data, sends NETBSD_DM_IOCTL (0xc010fd00) to /dev/mapper/control via prop_dictionary_send_ioctl.
• build.sh (cc -lprop) / run.sh (kldload dm; ./df2229).

Fix (fix.diff)

Add the missing prop_object_is_array(pa) guard at the top of all four unguarded accessors, matching the pattern used by the seven already-guarded ones in the same file: - prop_array_iterator: if (!prop_object_is_array(pa)) return (NULL); - prop_array_make_immutable: if (!prop_object_is_array(pa)) return; - prop_array_mutable: if (!prop_object_is_array(pa)) return (false); - prop_array_externalize: if (!prop_object_is_array(pa)) return (NULL); Matches the finding markdown's proposal (add the type guard before the rwlock/deref).

Fix validation (rebuilt kernel)

prop_array.c is part of the in-kernel libprop, so the validation rebuilds the kernel (make -j6 nativekernel KERNCONF=X86_64_GENERIC): - Baseline (#0): ./df2229 → Fatal trap 12: page fault at prop_array_iterator+0x1b (NULL deref, addr 0x40) (2/2 fresh-reset runs). - Fixed (#1, sha256 9fb1b67f..., fix.diff applied): ./df2229 → prop_dictionary_send_ioctl returned 2 (ENOENT — the guarded prop_array_iterator(NULL) now returns NULL; dm_table_load_ioctl then proceeds to dm_dev_lookup which fails for the non-existent device and returns ENOENT), no panic, guest stays up (uptime healthy). fix_status = fixed.