Full-duplex journal ack-path loss permanently wedges all writers in uninterruptible, SIGKILL-immune kernel sleep — and mountctl -d frees the journal out from under the sleepers (demonstrated wake-through-reuse UAF)

Summary

In full-duplex mode xindex is advanced only by journal_rthread on acks; the rthread silently exits on the first EOF/error/short read or bad ack magic (plain-file or dead/lying socket target = immediate). journal_reserve's stall path then tsleeps uninterruptibly ('jwrite', flags=0, no timeout, no STOP_REQ escape; STOP_IMM is unimplemented) forever once the memfifo fills with un-acked bytes — every VOP on the mount wedges unkillably. mountctl -d completes anyway, kfree'ing struct journal and the fifo while the sleepers persist on &jo->fifo.windex inside freed memory; a later same-size allocation whose wakeup hits the recycled address wakes them to execute on freed→reused state (rawp = membase + (windex & mask) writes attacker-payload records into whatever now occupies the old addresses).

Threat model & preconditions

Root configures two-way journaling (the feature's stated purpose is off-site mirroring over untrusted networks; the wire protocol is unauthenticated — magic constants only, so a dead, blocking or malicious mirror triggers it remotely). Thereafter every unprivileged user writing to the mount becomes unkillably wedged (D-state, holds vnode locks); the mount cannot be used or unmounted; after cleanup, the freed-under-sleeper condition plus heap reuse yields a UAF write primitive (demonstrated wake; arbitrary-object write traced).

Proof of contest

VERIFIED on the guest (findings/poc/DF-2748/): mountctl -2 -w j2.bin memfifo=64k → rthread reads EOF and exits instantly; unpriv writers → D4/D5 wchan=jwrite from t+5s; SIGKILL ineffective through t+60s; membufused/unacked pinned at 63K (frozen xindex), fifo_stalls=2; mountctl -d succeeds → jo+membase freed while sleepers persist; installing a new 64K journal and generating load WOKE the zombies through the reused wchan — they ran on freed→reused journal state, completed the syscall, and only then took the pending SIGKILL. Patched kernel (gate full-duplex on a live MC_JOURNAL_RACTIVE, degrading to half-duplex): never wedges, killable, fifo drains to 0.

Recommended fix

Gate full-duplex behavior on a live rthread so the wthread takes over xindex advancement when the ack path dies (validated fix.diff); additionally implement the STOP_IMM/STOP_REQ escape in the 'jwrite'/'jpad' sleeps and drain/abort outstanding reservers in journal_destroy before kfree.

Timeline

• 2026-08-30 Discovered during pass-2 audit of vfs_journal.c (GLM 5.3); unpriv wedge + wake-through-reuse reproduced + fix validated same run.