No common lock between linesw[] mutation and dispatch — register/deregister swap entries under tty_token while TIOCSETD (t_token+p_token) and driver read/write/ioctl paths read the table under unrelated locks, permitting torn multi-pointer swaps
| Field | Value |
|---|---|
| ID | DF-2971 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-667 |
| File | sys/kern/tty_conf.c |
| Lines | 97-112, 125-129 (readers: tty.c:861-862/1137-1146; sio.c:1565 etc.) |
| Area | kern/tty |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
ldisc_register/ldisc_deregister mutate linesw entries with whole-struct copies (nine function/data pointers, not atomic) while holding only tty_token. But the dispatch consumers do NOT hold tty_token: ttioctl takes tp->t_token + p->p_token and its TIOCSETD close/open dance reads linesw[].l_close/l_open; driver dispatch sites (sio, usb_serial, nmdm, syscons, dcons, vkernel console) hold only their own locks. A kldload/kldunload running concurrently with an ioctl or driver dispatch can therefore observe a half-old/half-new linesw entry — e.g. TIOCSETD pairing the old disc's l_close with the new disc's l_open, or a read entering a discipline mid-teardown. Every transient pointer value is still-mapped kernel text, so the immediate effect is wrong-disc dispatch/ENODEV/DoS rather than direct corruption; the dangerous residual is the widened window where a thread holds a stale module function pointer across the linker freeing the module text (classic unload-execution race, root-initiated). Attacker model: privileged kldload/kldunload racing unpriv TIOCSETD/read/write churn. Not guest-verified (Low, privileged trigger per contract). Fix: snapshot the linesw entry under tty_token on the dispatch side then dispatch through the snapshot (production fix should be RCU/epoch or registry token held only for the fetch; row sketch for TIOCSETD).
Timeline
- 2026-09-02 Discovered during pass-2 audit of tty_conf.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2971 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 659 B | ↓ raw | |
| VERDICT.md | — | 2.2 KB | ↓ raw | |
| build.sh | — | 54 B | view raw | |
| dfv_safe.c | — | 21.8 KB | view raw | |
| env.txt | — | 401 B | view raw | |
| manifest.json | — | 597 B | view raw | |
| run.log | — | 126 B | view raw | |
| run.sh | — | 122 B | view raw | |
| verdict.json | — | 2.1 KB | view raw |
DF-2971 PoC evidence pack
What
No common lock between linesw[] mutation and dispatch: torn multi-pointer swaps observed at scale.
Build
make (KMOD dfv_safe)
Run
kldload dfv_safe.ko; sysctl -w dfv.t2971=1; dmesg | grep DF2971
Expected
197M unlocked snapshots: 3.2M torn (mixed old/new pointer) linesw entries
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).
DF-2971 - verification verdict
Status: reproduced | reproduced: 1 | impact: denial_of_service | confidence: likely
Torn whole-struct swaps measured at scale. A module thread alternated ldisc_register(8, A)/ldisc_register(8, B) (two disciplines differing in every function pointer) while a second thread snapshotted the 9-pointer linesw[8] entry WITHOUT tty_token - exactly the lock situation of the real dispatch sites (ttioctl holds t_token+p_token, tty.c:861-862/:1137-1146; drivers hold their own locks). 197,443,116 snapshots: 3,204,559 TORN entries (mixed old/new function pointers in one entry) - the non-atomic publish is directly observable; a dispatcher pairing old l_close with new l_open (TIOCSETD) or entering a disc mid-teardown reads the same torn state. Every transient pointer still points at mapped kernel text, so immediate effect is wrong-disc dispatch/ENODEV; the dangerous residual (execution into freed module text) requires kldunload racing. Dispatch-side snapshot fix documented (row sketch); no kernel patch compiled.
Evidence pointers
run.log DF2971: 197443116 snapshot reads: coherentA=46612515 coherentB=147626042 TORN=3204559
Kernel references
PoC changes vs the filing sketch
torn-read sampler instead of a racing dispatcher (safe observation of the same torn state)
Fix
recommendation: snapshot the linesw entry under tty_token on the dispatch side then dispatch through the snapshot (or RCU/epoch immutable array)
fix status: not_testable
dispatch-side redesign; documented, not compiled
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
(No fix.diff for this item: documented recommendation only - see Fix above.)
Fix verification
not_testabledispatch-side redesign; documented, not compiled
Confirmed kernel references
Detail
Evidence (decisive lines)
run.log DF2971: 197443116 snapshot reads: coherentA=46612515 coherentB=147626042 TORN=3204559
PoC changes
torn-read sampler instead of a racing dispatcher (safe observation of the same torn state)
Verified recommended fix
snapshot the linesw entry under tty_token on the dispatch side then dispatch through the snapshot (or RCU/epoch immutable array)
Verdict
Torn whole-struct swaps measured at scale. A module thread alternated ldisc_register(8, A)/ldisc_register(8, B) (two disciplines differing in every function pointer) while a second thread snapshotted the 9-pointer linesw[8] entry WITHOUT tty_token - exactly the lock situation of the real dispatch sites (ttioctl holds t_token+p_token, tty.c:861-862/:1137-1146; drivers hold their own locks). 197,443,116 snapshots: 3,204,559 TORN entries (mixed old/new function pointers in one entry) - the non-atomic publish is directly observable; a dispatcher pairing old l_close with new l_open (TIOCSETD) or entering a disc mid-teardown reads the same torn state. Every transient pointer still points at mapped kernel text, so immediate effect is wrong-disc dispatch/ENODEV; the dangerous residual (execution into freed module text) requires kldunload racing. Dispatch-side snapshot fix documented (row sketch); no kernel patch compiled.
No comments yet.