⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2441

dmstrategy and dmdump dereference dev->si_drv1 without NULL check unlike dmsize and disk_ioctl_switch

Summary

dmstrategy and dmdump unconditionally dereference dev->si_drv1 (dmv) without any NULL guard whereas dmsize and disk_ioctl_switch both defend against it. If si_drv1 ever NULL when strategy/dump entered immediate dereference at :401 (dm_table_size(&dmv->table_head)) or :488 faults kernel. Not reachable today: disk layer diskopen refuses open until d_slice set (populated by dmsetdiskinfo post-resume long after si_drv1 assigned). Inconsistency between 4 sibling entry points in same file is defense-in-depth gap would become live panic if future change relaxes d_slice gating or teardown path NULLs si_drv1 while bio in flight. [VERIFIED pass2: source-confirmed si_drv1 deref without the guards dmsize has; mirror-guards fix compile-validated]

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2441 · 8 files
FileTypeDescriptionSize
VERDICT.md — 1.6 KB ↓ raw
README.md — 238 B ↓ raw
build.sh — 85 B view raw
run.sh — 49 B view raw
env.txt — 314 B view raw
manifest.json — 698 B view raw
verdict.json — 2.1 KB view raw
fix.diff — 497 B view raw
README.md
↓ download raw

DF-2441 evidence pack

  • finding: sys/dev/disk/dm/device-mapper.c (365-488)
  • verdict: reproduced (certain) - see VERDICT.md
  • source-only confirmation (no runtime PoC)
  • reproduce: build.sh / run.sh
  • fix.diff: present, git-apply-able
VERDICT.md
↓ download raw

DF-2441 - Verification Verdict

Status: reproduced Impact: panic Confidence: certain

Mechanism

dmstrategy (line 365-366) and dmdump (line 474-475) dereference dmv = dev->si_drv1 with no NULL check - unlike dmsize and disk_ioctl_switch which both guard ((dmv = dev->si_drv1) == NULL). If a strategy/dump arrives in the window where the dm device is being destroyed (si_drv1 cleared before the dev is removed), the kernel NULL-derefs at dm_table_size(&dmv->table_head).

Verdict

source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Latent race-window panic (not deterministically triggerable without driving the destroy path under I/O; sibling rigs for other dm findings hit different, deeper races). Code-certain asymmetry versus the guarded dmsize at line 330 and line 542.

Threat / reachability

Race-window kernel panic on dm device destroy under I/O (root-configured devices).

Privilege escalation assessment

n/a (hardening)

Fix

Mirror the dmsize NULL guards in dmstrategy (fail the bio with ENXIO + biodone) and dmdump (return ENXIO).

Kernel references

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

not_testable

fix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier

batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
↓ fix.diffper-fix-DF-2441

Confirmed kernel references

Detail

Exploit chain

no escalation path (Info-tier hardening; see VERDICT.md)

Evidence (decisive lines)

VERDICT.md mechanism/verdict sections; fix.diff

PoC changes

none (source-only confirmation for this Info-tier item)

Verified recommended fix

Mirror the dmsize NULL guards in dmstrategy (fail the bio with ENXIO + biodone) and dmdump (return ENXIO).

Verdict

source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Latent race-window panic (not deterministically triggerable without driving the destroy path under I/O; sibling rigs for other dm findings hit different, deeper races). Code-certain asymmetry versus the guarded dmsize at line 330 and line 542.