DF-2462 PoC — ism_stop frees the session while CAM/ic_action and the per-session sysctl handlers can still dereference it (UAF)

• File under test: sys/dev/disk/iscsi/initiator/isc_sm.c:724-777 (ism_stop), with the victim paths isc_cam.c:201-309 (ic_action) and isc_sm.c:630-676 (isc_dump_stats, isc_sysctl_targetName/Address).
• Root cause: ism_stop() tears a session down IN PLACE. Between the CAM path teardown (ic_lost_target, isc_sm.c:752) and kfree(sp) (:777) the session stays reachable: sc->sessions[sp->sid] is cleared only at :772 and the per-session sysctl OIDs only at :774 (sysctl_ctx_free) — and neither ic_action() nor the sysctl handlers hold a lock or reference across their lookup→use, so any reader that already holds sp keeps dereferencing freed memory. The xpt_freeze_devq drain that would stop in-flight CAM traffic is #if 0'd out in ic_freeze (isc_cam.c:57-63).
• Windows (line-accurate):
• W-CAM — from entry into ism_stop (the :740-744 xmitter wait loop can sleep up to hz per iteration; iscsi_cleanup does logout I/O) until sessions[sid]=NULL (:772): ic_action()'s unlocked sp = isp->sessions[target_id] (isc_cam.c:211) returns the dying session. After :772 any reader that already loaded sp still holds it (no refcount) — unbounded.
• W-SYSCTL — the OIDs ...iscsiN.{targetname,targeaddress,stats,douio} stay registered until :774, and their handlers hold raw sp (stats: arg1 = sp) or raw &sp->opt.targetName pointers; a handler entered any time before removal dereferences sp with no lifetime guarantee. i_freeopt (:771) frees the option strings BEFORE sysctl_ctx_free (:774) removes the OIDs that resolve through them.
• W-AGGRAVATOR — if sysctl_ctx_free fails under concurrent readers it returns an error that ism_stop merely logs (:774-775); the session is still kfree'd at :777 with the OIDs left REGISTERED pointing into the freed chunk (observed live on the guest: "can't re-use a leaf (stats)!" on the next session's registration while an unprivileged user hammered the OID).
• Trigger preconditions (real driver): a configured iSCSI session being torn down (iscontrol exits / is killed → iscsi_close → ism_stop, iscsi.c:176; module unload → iscsi_stop → ism_stop, iscsi.c:851) while (a) CAM commands to the iscsi bus are in flight, or (b) ANY user reads the per-session sysctl OIDs (world-readable, no privilege needed — proven as uid 1001 in scenario S6).

Rig

Kernel-compiled verbatim interposition: df_pre.c + <verbatim isc_sm.c> + <verbatim isc_cam.c: ic_lost_target/_inq/_scsi_encap/ic_action> + <verbatim iscsi_subr.c: dwl/scsi_encap> + <verbatim isc_subr.c: i_freeopt> + df_post.c compiled into X86_64_GENERIC as dev/disk/iscsi/initiator/dfiscsi_harness.c (sha256-gated against the audit tree by build.sh). All interposition is #define-renames of external functions (xpt_async/xpt_free_path/xpt_done shims, isc_stop_receiver/iscsi_cleanup/i_pdu_flush/release_dev/destroy_dev shims, kfree → free+reclaim-and-poison, ksnprintf/kprintf → stall hooks); the driver text is byte-for-byte the gated source. Everything else is real: lockmgr, TAILQ ops, mtx_init/mtx_uninit, sysctl_ctx_free, kmalloc/kfree(M_ISCSI), i_freeopt, pdu_alloc, and the real userland sysctl path for the per-session OIDs.

Stall points (deterministic scheduling of the race): * teardown parked inside ic_lost_target (the xpt_async shim at isc_cam.c:90) — in-window; * CAM victim parked in ic_action between the sessions[] lookup (:211/:215) and the dereferences (:254 / _scsi_encap) — via the debug(4,"func_code...") kprintf at :217; * sysctl victim parked inside isc_dump_stats before touching sp — via the first ksnprintf (isc_sm.c:642).

Poison/reclaim: on the session kfree, the harness immediately reclaims the chunk (same size/type — the zone returns the same address) and fills it as an attacker-controlled object (FIXUP: valid mutexes/queues + chosen field values; FAULT: valid mutexes + garbage queue heads).

Build / run

./build.sh          # gate, push, generate TU, nativekernel, install, reboot
./run.sh            # baseline battery S0..S6, S7, then S5 (kills guest)
./make_fixed.sh     # apply fix.diff on the guest, rebuild, reboot
./run_fixed.sh      # A/B battery on the fixed kernel (S5 must survive)

Scenario map: * S0 control (live session; values are the A/B reference) * S1 in-window concurrent CAM read (teardown parked after ic_lost_target) * S2 UAF READ via verbatim ic_action (PATH_INQ reads sp->opt.maxluns from the freed chunk → cpi.max_lun) * S3 UAF READ/LEAK via verbatim isc_dump_stats (freed-chunk contents exported through SYSCTL_OUT) * S4 UAF WRITE via verbatim ic_action→scsi_encap→dwl/isc_qout/ i_nqueue_csnd (writes INTO the freed, attacker-reclaimed chunk) * S5 deterministic fault: same as S4 but the reclaim leaves garbage queue heads / lun table → kernel page fault (guest dies; baseline Fatal trap 12 ... scsi_encap+0x445, the dwl indexed write sp->target_lun[sp->target_nluns++] = lun with an attacker-controlled 32-bit index) * S6 unprivileged userland reads of the session OIDs while the teardown is parked in-window (uid 1001) * S7 natural race: unpriv userland sysctl hammer against a create/teardown loop with garbage-isc reclaim

Expected on the verbatim kernel

• S0: PATH_INQ: status=0x1 max_lun=2, stats recv=111 sent=222 ..., clean teardown.
• S1: S6: reads succeed against the being-torn-down session (sessions[7] still set; live values returned to uid 1001).
• S2: *** UAF READ PROVEN *** — cpi.max_lun=0x51515150 (0x51515151 planted in the reclaimed chunk).
• S3: *** UAF READ/LEAK PROVEN *** — planted values (flags=0x50505050, cws/cmd/exp/max/stat/itt = 0x65..-0x6a..) surface in the handler output.
• S4: *** UAF WRITE PROVEN *** — ncsnd incremented, csnd.tqh_first linked, target_lun[0]/target_nluns written inside the freed chunk.
• S5: guest dies: Fatal trap 12 ... supervisor write data ... Stopped at scsi_encap+0x445: movl %r13d,0x9c(%rbx,%rdx,4).
• S7: no natural hit in the runs performed (probabilistic); the ctx_free-failure aggravator (stale registered OIDs pointing at the freed session) was observed live.

Expected on the fixed kernel (A/B)

• S0 bit-identical to baseline (same status, same stats string).
• S1: PATH_INQ: status=0x8 (CAM_DEV_NOT_THERE) during the window.
• S2/S3/S4: teardown state after 3s: stop_done=0 free_seen=0 — ism_stop is HELD in the reference drain while the victim uses the session; victims observe LIVE values only; no freed chunk exists to read or corrupt while they run.
• S5: GUEST SURVIVED (baseline: Fatal trap 12).
• S6: the unprivileged reads surface no session data (handler returns ENODEV via the sid lookup; the sysctl tool prints no value).

Fix

fix.diff (4 files): detach sc->sessions[sid]=NULL to the top of ism_stop under sc->lock; add sp->refs + isc_sess_lookup()/isc_sess_rele(); ic_action looks up under sc->lock and takes a reference (released before returning); the per-session sysctl handlers take the sid as arg1 and resolve the session through isc_sess_lookup() (returning ENODEV once detached); ism_stop drains sp->refs before destroying the session and runs sysctl_ctx_free before i_freeopt.

DF-2462 VERDICT — verified

Finding. ism_stop() (sys/dev/disk/iscsi/initiator/isc_sm.c:724-777) destroys a session in place while two unlocked reader populations can still hold sp: CAM's ic_action() (sp = isp->sessions[target_id], isc_cam.c:211, no lock, no refcount; dereferenced at :215/:254 and through _scsi_encap→scsi_encap→dwl/isc_qout/i_nqueue_*) and the per-session sysctl handlers (isc_dump_stats etc., raw sp as arg1; OIDs registered until :774). The session stays in sc->sessions[] until :772 and is kfree'd at :777.

Status: REPRODUCED on the QEMU guest with a kernel-compiled verbatim-interposition harness (whole isc_sm.c + the ic_lost_target/_inq/_scsi_encap/ic_action/dwl/scsi_encap/ i_freeopt functions compiled byte-for-byte from the sha256-gated audit tree; all interposition via #define renames of externals). Every primitive was demonstrated by driving the REAL code:

• S2 — UAF read (CAM), certain. A victim thread parked inside verbatim ic_action between the sessions[] lookup and the sp->opt.maxluns read (the debug(4,"func_code…") call at isc_cam.c:217 compiles, through iscsivar.h:40-41, to a kprintf the harness intercepts). The teardown completed for real (ism_stop to kfree); the harness then reclaimed the freed chunk (same address — the M_ISCSI zone is LIFO) and planted opt.maxluns = 0x51515151. Resuming the victim: cpi.max_lun = 0x51515150 — the value read out of the FREED chunk was attacker-controlled. (run.log: "UAF READ PROVEN".)
• S3 — UAF read/info-leak (sysctl), certain. A victim parked inside verbatim isc_dump_stats before touching sp (first ksnprintf, isc_sm.c:642); teardown completed (sysctl_ctx_free really deregistered the OIDs, kfree really freed, chunk reclaimed with planted values); the handler then formatted and exported flags=0x50505050 pdus-alloc=0 pdus-max=0 cws=1701143909 cmd=66666666 exp=67676767 max=68686868 stat=69696969 itt=6a6a6a6a — seven fields read from the freed chunk, surfaced through SYSCTL_OUT. This handler is exactly what an unprivileged user invokes with sysctl iscsi.iscsiN.stats.
• S4 — UAF write (CAM), certain. Victim parked in ic_action with a SCSI_IO CCB; teardown freed + reclaimed the chunk (FIXUP: attacker object with valid mutexes/queues); the resumed verbatim path WROTE into the freed chunk, all observed: stats.ncsnd 0x52525252→0x52525253 (i_nqueue_csnd), csnd.tqh_first linked to a live pdu (TAILQ_INSERT_TAIL), target_lun[0] 0xbebebebe→0 and target_nluns 0→1 (dwl), plus flags |= ISC_OQNOTEMPTY (isc_qout).
• S5 — deterministic kernel fault, certain. Same as S4 but the reclaim models an unrelated allocation's garbage: the victim's dwl executes sp->target_lun[sp->target_nluns++] = lun with the garbage 32-bit index → write at sp + 0x9c + 4*idx: Fatal trap 12, supervisor write data, page not present … Stopped at scsi_encap+0x445: movl %r13d,0x9c(%rbx,%rdx,4) — guest down in DDB (panic.txt, panic.s5.fresh.txt). This is a relative-write primitive with an attacker-influenced index and value (idx = reclaimed target_nluns, value = CCB lun).
• S1/S6 — window reality + unprivileged reachability, certain. With the teardown parked just after ic_lost_target (the xpt_async shim = isc_cam.c:90), sc->sessions[7] is still set and the OIDs are still registered; uid 1001 (maxx) read all four session OIDs from userland and got live values. The unprivileged user can be the racing reader; only the teardown side needs the root-configured session (iscontrol dying, or the remote target/network dropping the connection — iscsi.c:176 / iscsi_subr.c:344-372 paths).
• S7 — natural race, not hit in the runs performed (7531 and 14271 unprivileged hammer reads against ~1-2.6k teardown cycles; the exploitable preemption window inside the 10-line handler is ~µs). The deterministic proofs above carry the finding. S7 did however surface the aggravator live: under concurrent readers sysctl_ctx_free FAILS, ism_stop only logs it (:774-775), and the session is kfree'd with the OIDs still registered — the next registration printed "can't re-use a leaf (stats)!" — i.e. the tree keeps OIDs whose arg1 points into freed memory until reboot.

Fix validation (A/B, certain). fix.diff (early sessions[sid]=NULL under sc->lock at the top of ism_stop; sp->refs + isc_sess_lookup/rele; ic_action lookup under the lock + reference; sid-based sysctl handlers returning ENODEV; drain before destruction; sysctl_ctx_free before i_freeopt): same harness around the PATCHED verbatim text, same battery: * S0 bit-identical to baseline (status/max_lun/stats string) — normal path unchanged; * S1: status=0x8 (CAM_DEV_NOT_THERE) during the window; * S2/S3/S4: teardown state after 3s: stop_done=0 free_seen=0 — ism_stop is HELD in the drain while the victim runs; victims observe only LIVE values (S2: max_lun=0x2; S3: the exact S0 string; S4: "no freed chunk exists to corrupt"); * S5: GUEST SURVIVED (baseline: Fatal trap 12); * S6: unprivileged reads surface no session data (handler ENODEV).

Privilege-escalation assessment (closed with facts). No unpriv→root chain is demonstrated, and none is realistic here: 1. The unprivileged reader (sysctl) reaches isc_dump_stats/ targetname handlers — a READ-only path. Demonstrated ceiling for that user: (a) leak of freed-chunk contents (S3 — with attacker reclaim this is controlled-data echo, without it stale session fields), and (b) a kernel fault when the freed chunk is reused by unrelated data (S5-class dereference of garbage sp->isc / queue heads) → local DoS from an unprivileged user racing a root-initiated teardown. Turning (a) into a useful KASLR/heap leak yields fixed-offset ints, not pointers; the strings handlers read *cp which i_freeopt NULLs, so they do not leak adjacent heap either. 2. The WRITE primitive (S4/S5: TAILQ links + indexed target_lun[] write with attacker-controlled index/value) rides the CAM path (ic_action → scsi_encap), which in the real driver is reachable only through the iscsi SIM's registered bus — issuing CCBs to it requires the da periph, i.e. root/operator access to the iscsi-backed disk, or in-flight I/O at teardown time (root-configured workload). An already-privileged actor corrupting freed memory has no escalation to gain. 3. The reclaim-controlling attacker in S4 writes into memory they already own (their own reallocated chunk); the dangerous direction — the kernel later walking attacker-forged queue heads in sp->hld/csnd — requires the session's sm thread and receiver to still run, but ism_stop stops both (:734-744) before the free. The post-free readers demonstrated here (ic_action, sysctl) only read fields and push one pdu onto a queue nobody drains. Conclusion: real, proven memory-safety violation whose realistic impact is unprivileged info-leak/DoS during legitimate teardown plus privileged-context corruption — consistent with (and arguably at the top of) the filed Medium severity; NOT a practical uid-0 vehicle. (The upstream FreeBSD initiator was rewritten wholesale (iscsi/icl) years ago; this DF driver is on the legacy list.)

Harness bugs found and fixed during verification (documented so the rig is reusable): (1) blocking inside a sysctl handler deadlocks against sysctl_ctx_free's SYSCTL_XLOCK because kern_sysctl.c:1573-1576 holds the pcpu SHARED sysctllock across the handler — the control interface now returns immediately and run.sh polls; (2) a single sleep channel for all gate flags livelocked concurrent waiters — per-flag channels now; (3) S2/S3/S4 originally ran the teardown inline, which the FIXED kernel's drain (correctly) blocks — teardown now runs in its own thread with a settle gap. None of these touched the driver text or the demonstrated outcomes.

Artifacts. run.log (baseline battery, kernel #4), run.s7.log, run.s5.log, panic.txt / panic.s5.fresh.txt (identical S5 fault signatures from two independent baseline batteries), leak_sample.txt (S3/S2 across runs), run_fixed.log, run_fixed_s5.log ("GUEST SURVIVED"), run_fixed_s7.log, s6_fixed_read.log, build.log / fix_build.log / fix_installkernel.log / fixed_gate.log, gen.log / gen_fixed.log, serial_fixed_debug.txt, env.txt, df_pre.c/df_post.c/gen.sh, build.sh/run.sh/make_fixed.sh/ run_fixed.sh, fix.diff.

Bottom line: the UAF is real, reachable, and mechanically proven on both victim populations (CAM read+write, sysctl read/leak), it kills the guest when the freed chunk is reused, the proposed fix.diff closes every demonstrated window while keeping the normal path bit-identical, and the escalation ceiling is leak/DoS — no unpriv→root chain exists on this path.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.