DF-2875 — pipelined BLK_WRITE: single-slot iost->data aux tracking →

premature kfree of in-flight bp->b_data (UAF during disk I/O) + leak

What this pack contains

• dfpeer.c — dmsg wire peer (socketpair + DIOCRECLUSTER + hand-crafted DMSG_BLK_* frames; the kernel reader verifies no CRCs, so frames are hand-built).
• run_f2.sh — the trigger + readback scan + malloc accounting.
• f2_scan.txt — readback of all written offsets after 10 rounds:
• W2 slots containing aa aa aa aa (the victim bio DMA'd a reclaimer's buffer contents — the freed slot was reallocated before the DMA),
• a W2 slot containing 53 ff 00 f0 (raw allocator/kernel memory persisted to disk),
• several slots containing ASCII "cals" (kernel heap string data persisted to disk).
• f2_mem_before.txt / f2_mem_after.txt — vmstat -m dmsg_disk: in-use 2.19K → 2.28M across 10 rounds (orphaned detached aux).
• fix.diff (kern_dmsg.c/subr_disk.c hunks included for completeness) — per-bio aux ownership via bio_caller_info2.ptr.

Build & run (root on the DF guest; root == stand-in for the

authenticated dmsg cluster peer, the same threat position as DF-0117)

cc -O -Wall -o /tmp/dfpeer dfpeer.c        # build.sh
pkill -f hammer2                            # free boot-time disk iocoms
sh run_f2.sh                                # run.sh (~2 min)

Expected output (stock kernel)

• pipelines: 10 rounds done
• readscan anomalies: W2 slots (off+005/007/009... odd 6*i+1 offsets) showing aa aa aa aa, 53 ff 00 f0, or ASCII garbage instead of their own 0x22+r pattern
• dmsg_disk in-use growth ~2.3MB (leak)

On the fix kernel, the same run shows every slot with exactly its own pattern (W1 0x11+r, W2 0x22+r, reclaimers 0xAA) and no dmsg_disk growth.

DF-2875 VERDICT

Status: reproduced (memcorrupt — deterministic premature free of an

in-flight disk-I/O buffer; peer-controlled)

Guest: DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC (see env.txt), QEMU virtio boot disk /dev/vbd0 (30GB; 7.5MB unused tail gap used as the write sandbox).

What was run

run_f2.sh: 10 rounds of a single BLK_WRITE transaction streaming W1(4KB, pattern 0x11+r) → W2(128KB, 0x22+r) → R1..R4(128KB, 0xAA, last carries DELETE), all pipelined while earlier bios are still in flight; then a full readback scan of all 60 slots (readscan).

Observed (stock kernel)

1. Premature free / UAF on in-flight bp->b_data — diskiodone for W1's bio frees iost->data, which by then contains the aux of the most recent write (R4), while R4's bio is still queued (sys/kern/subr_diskiocom.c:440 detach-overwrite, :606 free-on-any- completion). Readback: - W2/reclaimer slots showing aa aa aa aa where their own pattern should be — the freed buffer was reallocated (reclaimer aux, same kmalloc size class, M_DMSG_DISK) before the victim bio's DMA, so the disk received another message's payload (f2_scan.txt: off+003/005/009... aa aa aa aa). - off+014: 53 ff 00 f0 and several slots with ASCII "cals" — kernel heap contents persisted onto the raw disk through the freed-then-reused buffer (info-leak-onto-disk primitive; readable back by the same peer via BLK_READ).
2. Memory leak — vmstat -m dmsg_disk in-use grew 2.19K → 2.28M across the 10 rounds: every detached aux except the one freed by the first completion is orphaned (aux1 of each round + intermediates).
3. No panic on this (non-INVARIANTS) kernel; the racy double-free variant (two concurrent diskiodone on the same iost between the if (data->aux_data) check and the NULL store in kdmsg_free_aux_data) was not needed to prove the bug — the sequential premature-free is fully deterministic.

Threat model

Any dmsg peer of a disk iocom: a remote HAMMER2 cluster node routed by the hammer2 service daemon (which DIOCRECLUSTERs every disk at boot, sbin/hammer2/cmd_service.c:898), or any local process holding the peer end of the cluster pipe. Same position as DF-0117. The attacker controls message contents, sizes (aux 512B..1MB), count, and timing → controls which kmalloc zone is freed-under-DMA and when reclamation happens. On this permissive guest (no SMAP/SMEP/KASLR) the primitive is a classic exploitable UAF: content-controlled kernel heap object freed while referenced by in-flight DMA, with attacker-driven reallocation.

Exploit chain (memcorrupt → uid0 route)

1. Peer streams pipelined BLK_WRITEs in one transaction with aux size class C (victim object's zone).
2. First completion frees the newest C-sized buffer under the in-flight bio; subsequent message aux allocations (same zone, same thread) reclaim it; the pending DMA then reads the replacement object's bytes and writes them to attacker-chosen disk offsets — kernel heap disclosure to disk (proven: "cals", 53 ff 00 f0).
3. Repeating with target zones yields pointer/contents disclosure; combined with write-side grooming (the same freed slot can be re-detached), full kernel-memory corruption is reachable. uid0 was not attempted end-to-end on this guest because the peer already runs as root here; on a real cluster the peer is a remote node and the primitive is remote-kernel-memory corruption.

Fix validation

fix.diff (per-bio aux ownership via bio_caller_info2.ptr) applied to the guest /usr/src, kernel rebuilt (make nativekernel), PoC re-run: readback shows every slot with exactly its own pattern and dmsg_disk usage returns to baseline (see run.fix.log). Bug dead.