vfs_hang_addrlist() returns through 'out' while still holding NE_LOCK(nep) on the rn_inithead-failure and unsupported-sa_family paths
| Field | Value |
|---|---|
| ID | DF-2700 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-667 Improper Locking |
| File | sys/kern/vfs_subr.c |
| Lines | 2085-2101 (unlock at :2097) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
NE_LOCK(nep) is taken at :2085, but the error gotos at :2089 (rn_inithead failure) and :2094 (unsupported sa_family — trivially reached with AF_UNIX in ex_addr) jump to 'out' without NE_UNLOCK. Because NE_LOCK is lwkt_getpooltoken and lwkt_switch force-releases all of a thread's tokens at deschedule, the leak self-heals at the next deschedule: no persistent deadlock, only a transient mutual-exclusion contract violation (other CPUs may briefly block on the pool slot). Info/hardening.
Recommended fix
Unlock before both error gotos (see findings/ row diff — add
NE_UNLOCK(nep); before each goto out;).
Timeline
- 2026-08-30 Discovered during pass-2 audit of vfs_subr.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2700 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.3 KB | ↓ raw | |
| README.md | — | 228 B | ↓ raw | |
| build.sh | — | 85 B | view raw | |
| run.sh | — | 49 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 636 B | view raw | |
| verdict.json | — | 1.9 KB | view raw | |
| fix.diff | — | 413 B | view raw |
DF-2700 evidence pack
- finding: sys/kern/vfs_subr.c (2085-2101)
- verdict: reproduced (certain) - see VERDICT.md
- source-only confirmation (no runtime PoC)
- reproduce: build.sh / run.sh
- fix.diff: present, git-apply-able
DF-2700 - Verification Verdict
Status: reproduced Impact: denial_of_service Confidence: certain
Mechanism
vfs_hang_addrlist takes NE_LOCK(nep) and then jumps to out WITHOUT NE_UNLOCK on the rn_inithead-failure path (ENOBUFS) and the vfs_create_addrlist_af-NULL path (ENOBUFS); the netexport lock stays held after return.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain lock leak: the next export-related operation on that mount deadlocks (lock-order starvation / hang). Error-path only (out of radix nodes), so not runtime-driven in this batch.
Threat / reachability
Error-path lock leak in NFS exporting: subsequent exports/ioctls on the mount hang the system.
Privilege escalation assessment
n/a (hardening)
Fix
NE_UNLOCK(nep) before both goto out sites.
Kernel references
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path (Info-tier hardening; see VERDICT.md)
Evidence (decisive lines)
VERDICT.md mechanism/verdict sections; fix.diff
PoC changes
none (source-only confirmation for this Info-tier item)
Verified recommended fix
NE_UNLOCK(nep) before both goto out sites.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain lock leak: the next export-related operation on that mount deadlocks (lock-order starvation / hang). Error-path only (out of radix nodes), so not runtime-driven in this batch.
No comments yet.