DF-2704 — vop_cache_operate_ap reads mnt_vn_journal_ops without synchronization (UAF window vs journal_detach kfree)

File: sys/kern/vfs_vopops.c (pass 2, GLM 5.3) Severity: Low (speculative, root-gated trigger) — Confidence: speculative

What

vop_cache_operate_ap() (sys/kern/vfs_vopops.c:1774-1786) — the cache-coherency dispatch layer that every VOP on a journalled mount flows through — reads the mount's journal-ops pointer with no lock:

ops = ap->a_ops;
if (ops->head.vv_mount->mnt_vn_journal_ops)          /* :1781 unlocked read */
        error = VOCALL(ops->head.vv_mount->mnt_vn_journal_ops, ap);  /* :1782 */
else
        error = VOCALL(ops->head.vv_mount->mnt_vn_norm_ops, ap);

The teardown side, journal_detach() (sys/kern/vfs_jops.c:247-252), calls vfs_rm_vnodeops(mp, &journal_vnode_vops, &mp->mnt_vn_journal_ops) (sys/kern/vfs_init.c:143-162), which does *ops_pp = NULL; ... kfree(ops, M_VNODEOP) — also with no lock that a concurrent VOP thread holds.

A thread that passes the NULL check at :1781 and then loses the CPU can VOCALL through a struct vop_ops that has just been kfree()d → use-after-free function-pointer dispatch (kernel-controlled contents of the freed M_VNODEOP slab slot; on this 64-bit build VOCALL is (*(vocall_func_t *)((char *)vops + sd_offset))(ap) — sys/sys/vnode.h:407).

Trigger path and why it is only Low/speculative here

• Attaching/detaching journals is only possible through the mountctl(2) syscall, which is gated: sys_mountctl() requires no jail and caps_priv_check_td(td, SYSCAP_RESTRICTEDROOT) (sys/kern/vfs_syscalls.c:1277-1283). So the free side needs root (the journaling rc scripts run it at mount time; a failed MOUNTCTL_INSTALL_VFS_JOURNAL also auto-detaches, vfs_jops.c:176-179).
• The racing reader side is any in-flight VOP on the same mount from any user.
• Window is one load-to-indirect-call sequence; no known in-tree workload detaches journals under load. Practical exploitability is low, but the protocol is genuinely unsynchronized (no mnt_token, no refcount on vop_ops — vfs_add_vnodeops/vfs_rm_vnodeops in sys/kern/vfs_init.c:113-162 are lock-free).

Recommended fix (upstream-appropriate direction)

Serialize journal ops swap against the dispatch layer — e.g. take lwkt_gettoken(&mp->mnt_token) around the mnt_vn_journal_ops read in vop_cache_operate_ap/vop_journal_operate_ap and around the pointer swap+free in vfs_rm_vnodeops (journal ops themselves already run under mnt_token in tmpfs/hammer handlers), or refcount the struct vop_ops (ops_pp) with waitrefs before kfree.

Reproduction status

Not executed (Phase V skipped): speculative root-gated race, Low severity; a deterministic reproduction would require a root-driven journal install/remove storm plus injected scheduling delays, which is out of proportion to the finding's severity class per the audit contract.

VERDICT — DF-2704

status: untested (Phase V deliberately skipped: Low, speculative, root-gated trigger; deterministic reproduction would need a root mountctl storm plus scheduler manipulation).

Analysis

Race protocol violation spanning three files; the reader is in the audited file:

1. Reader: vop_cache_operate_ap() sys/kern/vfs_vopops.c:1774-1786 — ops->head.vv_mount->mnt_vn_journal_ops loaded twice (:1781 test, :1782 call) with no token/refcount. (vop_journal_operate_ap :1793-1803 has the same shape but only reads mnt_vn_norm_ops, which is never freed while the mount lives.)
2. Swapper/free-er: journal_attach/journal_detach sys/kern/vfs_jops.c:233-252 → vfs_add_vnodeops/vfs_rm_vnodeops sys/kern/vfs_init.c:113-162 — *ops_pp = NULL then kfree(ops, M_VNODEOP), no synchronization with in-flight VOP threads (vnodes reach the ops via *(vp)->v_ops which points at &mp->mnt_vn_use_ops, sys/kern/vfs_mount.c:209, re-read per call, so the use pointer swap itself is safe; it is the journal_ops pointer lifetime that is not).
3. Gate: sys_mountctl root-only (sys/kern/vfs_syscalls.c:1277-1283, SYSCAP_RESTRICTEDROOT + no-jail), so only root can start the free side.

Worst case is a function-pointer call through freed M_VNODEOP memory (VOCALL = cast-of-offset indirect call, sys/sys/vnode.h:407) — i.e. a kernel-controlled-but-not-attacker-shaped UAF dispatch, triggered by root action racing user-triggerable VOP traffic.

Honest classification

• Real protocol flaw: yes — read the three call sites; nothing serializes them.
• Exploitable by an unprivileged user alone: no — the free requires root mountctl (journal remove or failed install auto-detach).
• Deterministic PoC cost vs. severity class: disproportionate (needs root helper
• schedule-injection). Per audit contract, Low speculative findings are not taken to the guest.

Recommended follow-up: file the serialization fix (mnt_token or ops refcount) with upstream; if the team wants a live demo, a root loop of mountctl install/remove journalling on a tmpfs while a user hammers write(2) under debug.cpumask pinning is the cheapest stress shape.