DF-2346 — SIGIO recipient stored as raw unreferenced struct proc * (usb_dev.c)

Verdict: NOT REPRODUCED (HW-gated); REAL BUG IN SOURCE (defense-in-depth fix warranted)

Hardware gate (why the PoC cannot run on this guest)

The vulnerable field is f->async_p on a USB FIFO (struct usb_fifo), which is created per USB device endpoint and exposed as a /dev/ugen<N>.<ep> character device. The audit QEMU/KVM guest has no USB device attached, so there are no FIFOs and no ugen nodes:

$ usbconfig list                  # No device match or lack of permissions.
$ ls /dev/ugen*                   # No such file or directory
$ ls /dev/usb*                    # only /dev/usbctl
$ ls -la /dev/usbctl              # crw-r--r--  root operator  (no group write)
$ id maxx                         # uid=1001 gid=1001 groups=1001  (NOT in operator)

Direct probe run as maxx (see maxx_open_probe.txt):

open("/dev/usbctl", O_RDWR)   -> -1     (EPERM: write needs root)
open("/dev/usbctl", O_RDONLY) -> 3      (read OK, but read-only fd is useless here)

Even the read-only fd does not reach the bug: f->async_p = USB_TD_GET_PROC(td) lives in the per-FIFO usb_ioctl() case FIOASYNC (usb_dev.c:1038-1044), dispatched on a ugen endpoint fd. /dev/usbctl's ioctl entry is usb_static_ioctl (bus/device enumeration control ioctls), not the FIFO ioctl, and FIONBIO/FIOASYNC on usbctl are "handled by upper FS layer" (usb_dev.c:1035). With no USB device → no ugen endpoint → no USB FIFO → the f->async_p = USB_TD_GET_PROC(td) assignment is unreachable by any user.

The bug's trigger (fork + parent exit + child USB completion) additionally requires an active async transfer on an open ugen FIFO, which presupposes the USB device the PoC relies on.

Source trace — the bug is REAL (sys/bus/u4b/usb_dev.c)

struct usb_fifo carries (usb_dev.h:110):

struct proc *async_p;     /* process that wants SIGIO */

assigned in the per-FIFO usb_ioctl (usb_dev.c:1038-1048):

case FIOASYNC:
    if (*(int *)addr) {
        if (f->async_p != NULL) { error = EBUSY; break; }
        f->async_p = USB_TD_GET_PROC(td);   /* usb_dev.c:1044 */
    } else
        f->async_p = NULL;
    break;

USB_TD_GET_PROC(td) = td->td_proc (usb_dragonfly.h:58) — a raw struct proc * taken with no reference (no PHOLD() / refcount increment) and no registration on proc->p_sigiolst.

It is then dereferenced locklessly in usb_fifo_wakeup (usb_dev.c:1789-1791):

if (f->async_p != NULL && lwkt_trytoken(&f->async_p->p_token)) {
    ksignal(f->async_p, SIGIO);
    lwkt_reltoken(&f->async_p->p_token);
}

and the same pattern in usb_fifo_close (usb_dev.c:798-801).

Every other async-signal character device in the tree (pipe, socket, tty, bpf, tap, tun, kqueue, evdev, drm) uses the refcounted struct sigio / fsetown / pgsigio mechanism. USB bypasses it. After fork(), the child inherits the open ugen FIFO with async_p == parent's proc; the parent can exit() and be reaped, freeing the proc struct. The next USB transfer completion calls usb_fifo_wakeup → lwkt_trytoken(&f->async_p->p_token) on a freed proc → UAF. Floor: reliable kernel panic / local DoS. Ceiling: proc slab reuse → heap grooming for code execution.

Attacker: operator-group/desktop user opens a ugen endpoint, enables FIOASYNC, forks, parent exits; child triggers a completion. Requires an attached USB device providing an endpoint FIFO.

Exploit chain status

Not pursuable — primitive (lockless UAF on struct proc) requires an open ugen FIFO, which requires an attached USB device (absent) — valid Phase-6 hard blocker: dead path at runtime on this guest. On a desktop with a USB device plugged in this is a real write-capable UAF.

PoC changes

Authored a small reachability probe (maxx_open_probe.txt) confirming maxx cannot get a writable FIFO fd on this guest. No exploit chain written: no USB device → no FIFO → no async_p assignment.

Recommended fix

Convert f->async_p to the refcounted struct sigio * mechanism (fsetown/ pgsigio/funsetown), matching every other async-signal char device. See fix.diff for a minimal defense-in-depth fix that takes a proc reference (PHOLD) on assignment and releases it (PRELE) on clear/close, closing the UAF (a full sigio refactor is the proper long-term fix).