fp_mmap maps VCHR vnodes without the revoked-device (v_rdev == NULL) guard its sibling kern_mmap has: NULL-deref panic in vm_mmap
| Field | Value |
|---|---|
| ID | DF-2899 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-476 NULL Pointer Dereference |
| File | sys/kern/kern_fp.c |
| Lines | 473, 489-551 (sink: vm/vm_mmap.c:1356) |
| Area | kern |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
fp_mmap validates a VCHR vnode only via vp->v_type and iszerodev(vp->v_rdev) (pure pointer compare, no deref), then unconditionally passes handle=vp to vm_mmap. vm_mmap dereferences vp->v_rdev->si_ops->d_uksmap (vm_mmap.c:1356/1367) and hands v_rdev to dev_dmmap_single/dev_pager_alloc. If the char device was revoked/destroyed (v_rdev cleared on the live vnode), this is a NULL-page kernel fault → panic. The syscall path kern_mmap performs exactly this check ("Make sure a device has not been revoked", vm_mmap.c:285-288 → EBADF); fp_mmap — a line-for-line snarf of that code — omitted it. Only in-tree route is CKPT_THAW gated by ckptgroup=0 (wheel), racing device revocation between fp_vpopen and fp_mmap — semi-privileged, narrow race, NULL-deref panic (DoS) as the realistic ceiling. Not built (Low; per-contract skip) — maintainer sketch in the summary.
Recommended fix
Mirror the kern_mmap revoked-device check in fp_mmap's VCHR path
(if (vp->v_type == VCHR && vp->v_rdev == NULL) return (EBADF);).
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_fp.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2899 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 611 B | ↓ raw | |
| VERDICT.md | — | 1.7 KB | ↓ raw | |
| env.txt | — | 401 B | view raw | |
| fix.diff | — | 361 B | view raw | |
| manifest.json | — | 523 B | view raw | |
| verdict.json | — | 1.6 KB | view raw |
DF-2899 PoC evidence pack
What
fp_mmap maps VCHR vnodes without the revoked-device (v_rdev == NULL) guard its sibling kern_mmap has.
Build
(none)
Run
(none)
Expected
static confirmation (no run): kern_mmap guard present at vm_mmap.c:285-288, absent in fp_mmap
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).
DF-2899 - verification verdict
Status: not_reproduced | reproduced: 0 | impact: panic | confidence: likely
Line-accurate confirmation; trigger not honestly constructible. fp_mmap (kern_fp.c:473-551) validates a VCHR vnode only by v_type and iszerodev(vp->v_rdev) (pointer compare, kern_memio.c) and unconditionally passes handle=vp to vm_mmap at :550; the syscall-path sibling kern_mmap performs exactly the missing revoked-device check (vm_mmap.c:285-288: v_rdev == NULL -> EBADF) and vm_mmap derefs vp->v_rdev->si_ops->d_uksmap at :1356. The only in-tree route is CKPT_THAW (kern.ckptgroup=0 on this guest = wheel-only) racing device revocation inside one restore - a semi-privileged microsecond race. Fix (mirror the EBADF guard) compiled into the fix-all kernel.
Evidence pointers
source citations: kern_fp.c:473-550 lacks guard present at vm_mmap.c:285-288; deref at vm_mmap.c:1356
Kernel references
PoC changes vs the filing sketch
verification skipped per contract; static confirmation only
Fix
recommendation: mirror the kern_mmap revoked-device guard (EBADF) in fp_mmap
fix status: not_testable
compile-validated in fix-all kernel
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablecompile-validated in fix-all kernel
Confirmed kernel references
Detail
Evidence (decisive lines)
source citations: kern_fp.c:473-550 lacks guard present at vm_mmap.c:285-288; deref at vm_mmap.c:1356
PoC changes
verification skipped per contract; static confirmation only
Verified recommended fix
mirror the kern_mmap revoked-device guard (EBADF) in fp_mmap
Verdict
Line-accurate confirmation; trigger not honestly constructible. fp_mmap (kern_fp.c:473-551) validates a VCHR vnode only by v_type and iszerodev(vp->v_rdev) (pointer compare, kern_memio.c) and unconditionally passes handle=vp to vm_mmap at :550; the syscall-path sibling kern_mmap performs exactly the missing revoked-device check (vm_mmap.c:285-288: v_rdev == NULL -> EBADF) and vm_mmap derefs vp->v_rdev->si_ops->d_uksmap at :1356. The only in-tree route is CKPT_THAW (kern.ckptgroup=0 on this guest = wheel-only) racing device revocation inside one restore - a semi-privileged microsecond race. Fix (mirror the EBADF guard) compiled into the fix-all kernel.
No comments yet.