hammer2_volconf_update() uses iocom->conn_state unlocked across a peer-driven drop (TOCTOU): kdmsg_lnk_conn_reply mutates conn_state without msglk
| Field | Value |
|---|---|
| ID | DF-2709 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H |
| CWE | CWE-367 TOCTOU |
| File | sys/kern/kern_dmsg.c |
| Lines | 231-233 (unlocked drop), consumer hammer2_iocom.c:377-385 |
| Area | kern |
| Confidence | likely |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass — expands the DF-0906 TOCTOU with the reply-side mutation) |
| Bucket | memcorrupt |
| Reported | pending |
| Known CVE | none |
| CVE match | variant |
Summary
kdmsg_lnk_conn_reply() runs from the receive path without msglk and
does if (iocom->conn_state) kdmsg_state_drop(...); iocom->conn_state
= NULL; — an unlocked read/drop/store of a shared pointer.
hammer2_volconf_update() reads the same pointer from the
REMOTE_ADD/REMOTE_DEL ioctl thread and passes it to kdmsg_msg_alloc()
(first deref at :1770). Racing a peer-terminated CONN can
hold-after-free or hit the :1973 KKASSERT on INVARIANTS; the
in-source XXX acknowledges the race. Root ioctl caller racing a
malicious peer's CONN termination; narrow window.
Recommended fix
Protect conn_state with msglk on both sides: take msglk around the check+msg_alloc in hammer2_volconf_update (or add a kdmsg helper returning a referenced conn_state under msglk), and perform the drop+NULL in kdmsg_lnk_conn_reply under msglk.
References
- DF-0906 (the original TOCTOU note), DF-2666 (adjacent caller fp leak)
Timeline
- 2026-08-30 Discovered during pass-2 audit of kern_dmsg.c (GLM 5.3).
No comments yet.