dev_pager_dealloc runs cdev_pg_dtor before unlinking the object from dev_pager_object_list (and outside dev_pager_mtx): racing cdev_pager_allocate for the same handle clobbers the fresh object's si_object, making the later old_dev_pager_dtor KKASSERT(dev->si_object) a reachable panic
| Field | Value |
|---|---|
| ID | DF-2939 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-362 / CWE-617 |
| File | sys/vm/device_pager.c |
| Lines | 211-215 vs :130-165; panic sink :343 |
| Area | vm |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | memcorrupt |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
dev_pager_dealloc() calls ops->cdev_pg_dtor(dev) at :211 BEFORE taking
dev_pager_mtx and TAILQ_REMOVE-ing the object (deliberate ordering —
the comment warns DRM dtors may recurse into the pager).
old_dev_pager_dtor then does KKASSERT(dev->si_object);
dev->si_object = NULL with no lock. Meanwhile cdev_pager_allocate()
holding dev_pager_mtx can observe the dying object OBJ_DEAD-skipped,
create a NEW object for the same cdev and set dev->si_object =
new_object — entirely unsynchronized against the dtor's store. If the
dtor's NULL store lands after the allocator's store, the new object's
back-pointer is lost, and when that object is later deallocated
old_dev_pager_dtor's KKASSERT at :343 panics. Local DoS on
INVARIANTS/debug builds only (window is a few instructions); on
production kernels si_object is write-only bookkeeping — silent and
benign. Not run (Low/debug-only per contract); reproduction sketch:
two unprivileged processes looping {mmap, munmap} of the same
old-pager device. Fix: do the si_object bookkeeping under dev_pager_mtx
after the object is unlisted (conditional == object clear), reducing
old_dev_pager_dtor to release_dev(dev).
Timeline
- 2026-09-02 Discovered during pass-2 audit of device_pager.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2939 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 585 B | ↓ raw | |
| VERDICT.md | — | 1.7 KB | ↓ raw | |
| env.txt | — | 401 B | view raw | |
| fix.diff | — | 758 B | view raw | |
| manifest.json | — | 468 B | view raw | |
| verdict.json | — | 1.6 KB | view raw |
DF-2939 PoC evidence pack
What
dev_pager_dealloc runs the cdev dtor before unlinking: racing allocate clobbers si_object -> later KKASSERT panic.
Build
(none)
Run
(none)
Expected
static confirmation (no legacy d_mmap device on guest)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).
DF-2939 - verification verdict
Status: not_reproduced | reproduced: 0 | impact: panic | confidence: likely
Line-accurate confirmation; no trigger surface on this guest. dev_pager_dealloc runs cdev_pg_dtor (device_pager.c:211) BEFORE taking dev_pager_mtx and unlinking (:213-215); old_dev_pager_dtor does KKASSERT(dev->si_object) then dev->si_object = NULL unlocked (:343); cdev_pager_allocate sets dev->si_object under the mutex (:146-149) - the clobber window is real. But the old pager is only used by legacy d_mmap devices, and the guest has none (only nvmm with .d_mmap = nommap; no DRM/vga). Window is a few instructions wide even where devices exist. Fix (move si_object bookkeeping under dev_pager_mtx after unlist, conditional on identity) compiled into the fix-all kernel.
Evidence pointers
source ordering: device_pager.c:211 vs :213-215 vs :146-149 vs :343
Kernel references
PoC changes vs the filing sketch
no legacy d_mmap device present on guest
Fix
recommendation: si_object bookkeeping under dev_pager_mtx after unlist (conditional == object clear)
fix status: not_testable
compile-validated in fix-all kernel
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablecompile-validated in fix-all kernel
Confirmed kernel references
Detail
Evidence (decisive lines)
source ordering: device_pager.c:211 vs :213-215 vs :146-149 vs :343
PoC changes
no legacy d_mmap device present on guest
Verified recommended fix
si_object bookkeeping under dev_pager_mtx after unlist (conditional == object clear)
Verdict
Line-accurate confirmation; no trigger surface on this guest. dev_pager_dealloc runs cdev_pg_dtor (device_pager.c:211) BEFORE taking dev_pager_mtx and unlinking (:213-215); old_dev_pager_dtor does KKASSERT(dev->si_object) then dev->si_object = NULL unlocked (:343); cdev_pager_allocate sets dev->si_object under the mutex (:146-149) - the clobber window is real. But the old pager is only used by legacy d_mmap devices, and the guest has none (only nvmm with .d_mmap = nommap; no DRM/vga). Window is a few instructions wide even where devices exist. Fix (move si_object bookkeeping under dev_pager_mtx after unlist, conditional on identity) compiled into the fix-all kernel.
No comments yet.