flush_pagedep_deps: bwrite(inodedep->id_buf) dereferences id_buf after dropping the softdep lock — diverges from the file's own copy-first discipline (softdep_update_inodeblock), micro-window UAF read / NULL deref
| Field | Value |
|---|---|
| ID | DF-2992 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-367 / CWE-416 |
| File | sys/vfs/ufs/ffs_softdep.c |
| Lines | 4655-4660 (contrast :3944-3951) |
| Area | vfs/ufs |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | memcorrupt |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
In flush_pagedep_deps, after getdirtybuf(&inodedep->id_buf, MNT_WAIT) succeeds the code does FREE_LOCK(&lk) and then re-loads inodedep->id_buf as the bwrite argument. In the unlocked window another CPU holding lk can complete the inode's dependencies and free the inodedep (free_inodedep via handle_written_inodeblock/free_diradd) or clear id_buf (check_inode_unwritten), yielding bwrite on a garbage/NULL pointer. The sibling path softdep_update_inodeblock copies ibp = inodedep->id_buf BEFORE FREE_LOCK — the intended discipline this site violates. Reachable unprivileged via fsync on files with pending directory-entry dependencies (softdep_fsync → flush_pagedep_deps). Window is a handful of instructions wide; practical impact is a rare panic rather than controllable corruption. Not raced (Low per contract). Fix: copy id_buf to bp before FREE_LOCK (row diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of ffs_softdep.c (GLM 5.3). DF-0764/0765 re-verified, not re-reported (DF-2990's fix subsumes DF-0765).
No comments yet.