flush_pagedep_deps: bwrite(inodedep->id_buf) dereferences id_buf after dropping the softdep lock — diverges from the file's own copy-first discipline (softdep_update_inodeblock), micro-window UAF read / NULL deref
| Field | Value |
|---|---|
| ID | DF-2992 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-367 / CWE-416 |
| File | sys/vfs/ufs/ffs_softdep.c |
| Lines | 4655-4660 (contrast :3944-3951) |
| Area | vfs/ufs |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | memcorrupt |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
In flush_pagedep_deps, after getdirtybuf(&inodedep->id_buf, MNT_WAIT) succeeds the code does FREE_LOCK(&lk) and then re-loads inodedep->id_buf as the bwrite argument. In the unlocked window another CPU holding lk can complete the inode's dependencies and free the inodedep (free_inodedep via handle_written_inodeblock/free_diradd) or clear id_buf (check_inode_unwritten), yielding bwrite on a garbage/NULL pointer. The sibling path softdep_update_inodeblock copies ibp = inodedep->id_buf BEFORE FREE_LOCK — the intended discipline this site violates. Reachable unprivileged via fsync on files with pending directory-entry dependencies (softdep_fsync → flush_pagedep_deps). Window is a handful of instructions wide; practical impact is a rare panic rather than controllable corruption. Not raced (Low per contract). Fix: copy id_buf to bp before FREE_LOCK (row diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of ffs_softdep.c (GLM 5.3). DF-0764/0765 re-verified, not re-reported (DF-2990's fix subsumes DF-0765).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2992 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 590 B | ↓ raw | |
| VERDICT.md | — | 1.7 KB | ↓ raw | |
| env.txt | — | 401 B | view raw | |
| fix.diff | — | 845 B | view raw | |
| manifest.json | — | 464 B | view raw | |
| verdict.json | — | 1.6 KB | view raw |
DF-2992 PoC evidence pack
What
flush_pagedep_deps re-reads id_buf after dropping the softdep lock (copy-first discipline divergence).
Build
(none)
Run
(none)
Expected
static unlocked re-read confirmation (copy-first discipline divergence)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).
DF-2992 - verification verdict
Status: not_reproduced | reproduced: 0 | impact: panic | confidence: likely
Line-accurate confirmation of the unlocked re-read: flush_pagedep_deps succeeds in getdirtybuf(&inodedep->id_buf, MNT_WAIT), drops the softdep lock (FREE_LOCK at :4658), then re-loads inodedep->id_buf as the bwrite argument at :4659 - in the window another CPU holding lk can complete the inodes dependencies and free the inodedep or clear id_buf, unlike the sibling softdep_update_inodeblock (:3944-3951) which copies ibp BEFORE FREE_LOCK. The window is a handful of instructions on a path reached by unpriv fsync on files with pending dir-entry deps; a faithful race would need sustained multi-CPU softdep churn for hours with no guarantee - not attempted (Low). Copy-first fix compiled into the fix-all kernel.
Evidence pointers
source: ffs_softdep.c:4658-4659 vs :3944-3951 discipline divergence
Kernel references
PoC changes vs the filing sketch
race window not realistically constructible; line-accurate confirmation
Fix
recommendation: copy id_buf to bp before FREE_LOCK
fix status: not_testable
compile-validated in fix-all kernel (same file as DF-2991)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablecompile-validated in fix-all kernel (same file as DF-2991)
Confirmed kernel references
Detail
Evidence (decisive lines)
source: ffs_softdep.c:4658-4659 vs :3944-3951 discipline divergence
PoC changes
race window not realistically constructible; line-accurate confirmation
Verified recommended fix
copy id_buf to bp before FREE_LOCK
Verdict
Line-accurate confirmation of the unlocked re-read: flush_pagedep_deps succeeds in getdirtybuf(&inodedep->id_buf, MNT_WAIT), drops the softdep lock (FREE_LOCK at :4658), then re-loads inodedep->id_buf as the bwrite argument at :4659 - in the window another CPU holding lk can complete the inodes dependencies and free the inodedep or clear id_buf, unlike the sibling softdep_update_inodeblock (:3944-3951) which copies ibp BEFORE FREE_LOCK. The window is a handful of instructions on a path reached by unpriv fsync on files with pending dir-entry deps; a faithful race would need sustained multi-CPU softdep churn for hours with no guarantee - not attempted (Low). Copy-first fix compiled into the fix-all kernel.
No comments yet.