DF-2803 — Unbounded udev event-queue growth with an initiated-but-stalled reader

What

udev_event_insert() (sys/kern/kern_udev.c:500-532) queues every device event with no cap on udev_evqlen and no backpressure. Events are only reaped up to the oldest reader marker (udev_clean_events_locked, kern_udev.c:534-545), so one /dev/udev reader that has initiated (read() auto-initiates at kern_udev.c:826-830, UDEVPROP getdevs at kern_udev.c:973-979) but then stops reading pins the queue head, and kernel memory grows without bound for as long as device events are generated — each queued event holds a full prop_dictionary copy plus retained value objects.

The event source can be completely unprivileged: every posix_openpt() cycle creates and destroys ptm/pts cdevs, and devfs_create_dev_worker() fires udev_event_attach() for each (sys/vfs/devfs/devfs_core.c:1428). /dev/ptmx is mode 0666. Measured on the guest: ~12,000 events/second from one unprivileged process.

The reader gate is /dev/udev at 0600 root:wheel (kern_udev.c:1039-1041) — the same gate as DF-0055. Realistic stalled readers: a root/wheel attacker, or the udev-consuming daemon (devd) being slow or blocked while any user generates hotplug events.

Verified impact (guest, stock INVARIANTS kernel)

One unprivileged pty-churn process + one initiated-but-sleeping root reader:

baseline:   propdict    288 in-use (54.0K)
t+6s:       propdict 72.4K in-use (13.6M)   udev 72.3K
t+14s:      propdict  167K in-use (31.4M)   udev 167K
t+19s:      propdict  226K in-use (42.4M)   udev 226K
backlog drained after stall: 240,136 events (185 MB serialized) in 20s of churn

~90 MB of kernel memory queued in 19 s; growth is linear, unlimited, and per-churn-process multiplicative. Left running it exhausts kernel memory (objcache_get(M_WAITOK) sleeps / vm exhaustion wedge or panic).

Reproduce (guest)

./build.sh              # as root: builds /tmp/harness (root reader) + /tmp/churn (unpriv source)
sh /tmp/df2803_run.sh   # as root: baseline sample, 20s churn as user maxx,
                        # 30s stalled root reader, samples during stall,
                        # then non-blocking drain count of the backlog

Expected: harness: backlog drained: ~240000 events, vmstat -m propdict in-use climbing linearly during the stall and returning to baseline after the drain.

Files: harness.c (reader: stallcount mode), churn.c (unprivileged pty churn), run.sh, run.log (decisive run), build.log, fix.diff.

DF-2803 VERDICT — reproduced (dos)

Bottom line

Reproduced. With a single initiated-but-stalled root reader on /dev/udev and a single unprivileged pty-churn process (user maxx, /dev/ptmx 0666), the kernel udev event queue grew to 240,136 live events (~90 MB of kernel allocations across the propdict / prop_dictionary / propstng / udev malloc domains) in 20 seconds, with linear growth and no bound. This is a local kernel-memory-exhaustion DoS: the queue is bounded by nothing (udev_evqlen is incremented at sys/kern/kern_udev.c:517 with no limit check) and is drained only up to the oldest reader marker (kern_udev.c:539-545).

How it reproduces

1. harness stallcount 30 (root): open("/dev/udev") + ioctl(UDEVPROP, {"command":"getdevs"}). The ioctl marks the reader initiated (kern_udev.c:974-978), inserting its marker at the queue head — from now on udev_event_insert() (kern_udev.c:507) queues every device event. The harness then just sleeps.
2. churn 20 (user maxx): posix_openpt()/close() loop. Each cycle creates + destroys ptm/pts cdevs on the devfs core thread; each create fires udev_event_attach() (sys/vfs/devfs/devfs_core.c:1428) and each destroy fires udev_event_detach() (devfs_core.c:1451), each queueing an event carrying a full prop_dictionary copy (kern_udev.c:508-512).
3. Because the only reader never advances its marker, udev_clean_events_locked() reaps nothing; udev_evqlen and the prop-dict allocations grow linearly with churn (measured ~12k events/s, ~370 B retained per event, plus per-event dict copies of ~190 B).
4. After the stall window the harness switches the fd to non-blocking and drains: 240,136 events, 185 MB of XML — the direct measure of the queue backlog. Counters return to baseline after the drain (no leak in this variant; the leak variant is DF-2804).

Why the "needs root reader" gate does not neutralize it

• /dev/udev is 0600 root:wheel (kern_udev.c:1039-1041), identical gate to DF-0055 (filed Medium). The producer side is unprivileged and unlimited; the consumer side (devd/udevd) is a root daemon whose stall or slowness (blocked client, SIGSTOP, CPU starvation) turns any user's hotplug churn into unbounded kernel allocation. A root/wheel attacker triggers it trivially and deterministically as shown.
• The same churn with an actively-draining reader was measured as the control in the DF-2804 pack (S4 sample, flat) — the unbounded growth is specifically a function of reader lag, which the kernel never bounds.

Evidence

• run.log — baseline → t+6s/t+14s/t+19s samples during the stall (propdict 288 → 72.4K → 167K → 226K in-use; udev 139 → 226K), churn log (120,068 cycles / 20 s as user maxx), backlog drain count (240,136 events / 185,144,856 bytes), post-drain baseline return.
• harness.c (stallcount mode), churn.c.
• build.log — compiler output + guest environment.

Exploit chain (DoS)

posix_openpt() loop as any user + any initiated-but-lagging /dev/udev reader → linear, unbounded kernel heap consumption (~44 MB/min per churn process measured) → vm exhaustion → M_WAITOK sleeps / panic-wedge. No privesc path: the primitive is allocation pressure only; no controllable overflow exists in this queue (all copies are refcounted prop objects).

Fix

fix.diff — cap the queue (UDEV_EVQ_MAX) checked under udev_lk before consuming the copy; when full, drop the event (bump udev_seq and wake UDEVWAIT/kqueue listeners so consumers observe the drop) instead of growing unboundedly. Fix validated by reasoning only (DoS-class finding; kernel rebuild validation was not performed — fix_status: not_testable).

Kernel references

• sys/kern/kern_udev.c:500-532 — udev_event_insert, no bound
• sys/kern/kern_udev.c:517 — ++udev_evqlen (only accounting)
• sys/kern/kern_udev.c:534-545 — reap stops at oldest marker
• sys/kern/kern_udev.c:826-830, 973-979 — reader initiation
• sys/vfs/devfs/devfs_core.c:1428,1451 — event producers
• sys/kern/tty_pty.c:176 — unprivileged clone source (via /dev/ptmx 0666)