DF-2812 — elf_lookup() STB_LOCAL branch returns the resolved address as the int error code; *result never written → local-symbol relocations always fail (or write an uninitialized stack value)

Build

python3 gen_exec_ko.py globalsym.ko globalsym   # control: STB_GLOBAL symbol
python3 gen_exec_ko.py localsym.ko  localsym    # test:    STB_LOCAL symbol

The two modules are byte-identical except for one field: the st_info bind of the single in-module symbol "s" (defined: st_shndx=1, st_value=0x80) referenced by one R_X86_64_64 relocation.

Run

scp -F dfbsd-qemu/config globalsym.ko localsym.ko dfbsd:/tmp/
dfbsd-qemu/vm.sh run_root 'kldload /tmp/globalsym.ko; echo GLOBAL_RC=$?; kldunload -n /tmp/globalsym.ko'
dfbsd-qemu/vm.sh run_root 'kldload /tmp/localsym.ko; echo LOCAL_RC=$?'
dfbsd-qemu/vm.sh log 10       # console shows the failure message

Expected / observed (stock kernel, verified 2026-09-01)

globalsym: GLOBAL_RC=0  (loads; kldstat shows mapsize 0x1000; unloads fine)
localsym : link_elf: symbol s undefined      <- console
           kldload: an error occurred while loading module ... (RC=1)

Expected (patched kernel)

localsym : LOCAL_RC=0   (the defined local symbol now resolves)

Why (root cause, sys/kern/link_elf.c)

elf_lookup_fn (sys/sys/linker.h:327) is typedef int elf_lookup_fn(linker_file_t, Elf_Size, int, Elf_Addr *) — int return = error code, address delivered via *result. The machine relocation engine (sys/cpu/x86_64/misc/elf_machdep.c:123) does:

if (lookup(lf, symidx, 1, &addr))
        return -1;
val = addr + addend;        /* addr only set on the 0-return path */

link_elf.c's elf_lookup honors that contract on the global path (:1022) but the STB_LOCAL branch is a fossil of the pre-elf_machdep API:

1003:  if (ELF_ST_BIND(sym->st_info) == STB_LOCAL) {
1005:      if (sym->st_shndx == SHN_UNDEF || sym->st_value == 0)
1006:          return (ENOENT);
1007:      return ((Elf_Addr) ef->address + sym->st_value);   /* address as errno */
1008:  }

Consequences: - kernel-heap pointer truncated to int != 0 → elf_reloc_internal treats it as an error → every relocation against a defined STB_LOCAL symbol fails → "link_elf: symbol undefined" and the module cannot load (this is what the PoC demonstrates); - on the 1-in-2^32 chance the low 32 bits of (ef->address + st_value) are zero, lookup "succeeds" without setting *result, and val = addr + addend in elf_machdep.c:125 writes an UNINITIALIZED STACK VALUE into the relocated word of the module image.

The sibling loader is correct: link_elf_obj.c's elf_obj_lookup (:1134-1166) writes *result = ...; return (0); and its relocate_file skips locals entirely because link_elf_obj_reloc_local handles them via the same correctly-converted helper.

DF-2812 VERDICT — reproduced (defined local symbol fails to resolve: "link_elf: symbol s undefined")

Status: reproduced. Stock guest kernel DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC.

Evidence

Control module (STB_GLOBAL "s", one R_X86_64_64 reloc against it):

$ kldload /tmp/globalsym.ko; echo GLOBALSYM_RC=$?
GLOBALSYM_RC=0
 $ kldstat | tail -1
 4    1 0xfffff80116944000     1000 globalsym.ko
$ kldunload /tmp/globalsym.ko; echo UNLOAD_RC=0

(run.log) — the generator produces fully valid ET_EXEC KLD modules for link_elf_load_file, so the failure below is attributable solely to the bind byte.

Test module (byte-identical except st_info: STB_LOCAL "s"):

$ kldload /tmp/localsym.ko; echo LOCALSYM_RC=$?
kldload: an error occurred while loading module /tmp/localsym.ko. ...
LOCALSYM_RC=1
console: link_elf: symbol s undefined

(run.log) — the symbol is defined in the module itself (st_shndx=1, st_value=0x80) yet resolution fails.

Root cause

sys/kern/link_elf.c:1003-1008 — the STB_LOCAL branch of elf_lookup() returns the resolved kernel address as the function's int return value (the errno channel) and never writes the out-parameter:

    return ((Elf_Addr) ef->address + sym->st_value);   /* :1007 */

The contract (sys/sys/linker.h:327 typedef int elf_lookup_fn(..., Elf_Addr *), consumer sys/cpu/x86_64/misc/elf_machdep.c:123-125) is "nonzero return = failure; address via *result". The truncated heap pointer is nonzero, so elf_reloc_internal reports failure → relocate_file (sys/kern/link_elf.c:718-722) prints "symbol s undefined" and the load aborts. If the truncated value happened to be 0, elf_machdep.c:125 would instead compute val = addr + addend from an uninitialized stack addr and store it into the module image (uninitialized-stack-value write into kernel memory that the module then executes).

This is a half-converted fossil of the old Elf_Addr elf_lookup(...) API; the global branch at :1022 was converted correctly, and link_elf_obj.c's elf_obj_lookup (:1149-1150) shows the correct form (*result = ...; return (0);).

Impact

Root-gated (kldload). Primary observable: ET_EXEC KLD modules with STB_LOCAL relocations cannot load at all (functional bug present since the elf_machdep conversion), with a latent uninitialized-stack-value write on the measure-zero path. Low severity; security interest is the uninit write and the fact that the failure message itself routes through symbol_name() (the DF-0062 unbounded-st_name surface).

Fix validation

fix.diff converts :1007 to *result = (Elf_Addr) ef->address + sym->st_value; return (0);. Patched kernel: kldload /tmp/localsym.ko returns RC=0 (loads, relocates the local symbol correctly, unloads) — run_fix.log.