DF-2994 — WebNFS public-filehandle LOOKUP: vput() on unlocked vnode → guaranteed kernel panic

Build

cc -O -o /root/nfspoc nfspoc.c      # in-guest

Setup (root in guest)

/etc/exports:

/tmp/nfsroot -maproot=root
/ -public -index=missing.html -maproot=root

Start rpcbind, mountd, nfsd.

Run

NFSPOC_SRCPORT=831 NFSPOC_TIMEOUT=5 /root/nfspoc lookup0 /

(v3 LOOKUP, public filehandle encoded as fhlen=0, name "/")

Expected

Kernel panic within milliseconds:

panic: lockmgr: LK_RELEASE: no lock held
 vput() at vput+0x11
 nfsrv_lookup() at nfsrv_lookup+0x35b
 sys_nfssvc() ...

Guest drops to DDB (db>); ssh dies; vm.sh status => down.

Root cause

nfsrv_lookup sys/vfs/nfs/nfs_serv.c: - nfs_namei() returns the target vp LK_EXCLUSIVE locked (cache_vget, nfs_subs.c:1183). - Public-filehandle + VDIR + configured index file (nfs_pub.np_index, set by mountd from index= via vfs_setpublicfs, vfs_subr.c:2266-2293): line 565 vn_unlock(vp) before looking up the index. - If the index lookup fails (index file absent — the common case), the vp is never re-locked and never moved to dirp (line 574-589 skipped). - Line 599-604 or line 643 then calls vput(vp) on the unlocked vnode. - vput() = vn_unlock()+vrele() (vfs_lock.c:703-707) → lockmgr LK_RELEASE on an unheld lock → unconditional panic (kern_lock.c:767-768).

Preconditions

• NFS server exporting a filesystem with -public and index=<file> (WebNFS with index, RFC 2054/2055 style).
• The LOOKUP target resolves to a directory that does not contain the index file.
• The public filehandle is by definition pre-authenticated (that is its purpose), so no valid fh or credential is needed — only network reachability (and a reserved source port when vfs.nfs.nfs_privport=1).

DF-2994 — VERDICT

Status: REPRODUCED (impact: panic, confidence: certain, attempts: 1 + deterministic code path)

What was claimed

A v3 LOOKUP using the WebNFS public filehandle on an export configured with an index file that does not exist in the target directory makes nfsrv_lookup() call vput() on a vnode it already unlocked — guaranteed kernel panic.

How it was proven

Guest: DragonFly 6.5-DEVELOPMENT #0 (stock INVARIANTS kernel, KVM), exports:

/tmp/nfsroot -maproot=root
/ -public -index=missing.html -maproot=root

(mountd pushes -public + index= through vfs_export -> vfs_setpublicfs, sys/kern/vfs_subr.c:2266-2293, setting nfs_pub.np_index.)

$ NFSPOC_SRCPORT=831 /root/nfspoc lookup0 /
--- TRIGGER lookup0 public fh ---
(ssh session never returned; vm.sh status => down; DDB on serial)

Serial console (panic.txt):

panic: lockmgr: LK_RELEASE: no lock held
cpuid = 3
lockmgr_release() at lockmgr_release+0x11a
lockmgr_release() at lockmgr_release+0x11a
vput() at vput+0x11
nfsrv_lookup() at nfsrv_lookup+0x35b
sys_nfssvc() at sys_nfssvc+0x40f
syscall2() at syscall2+0x11e
Debugger("panic")

Exactly the predicted frame: nfsrv_lookup -> vput -> lockmgr_release panic.

Why it happens (code path, line-accurate)

• sys/vfs/nfs/nfs_subs.c:1182-1184 — nfs_namei() success returns the looked-up vp LK_EXCLUSIVE locked (cache_vget).
• sys/vfs/nfs/nfs_serv.c:550-565 — pubflag + target is VDIR + np_index != NULL: vn_unlock(vp) before looking up the index file relative to it.
• nfs_serv.c:568-572 — nlookup(index) fails (index file absent).
• nfs_serv.c:574-591 — the "found an index file" block (which would move the unlocked vp to dirp and cache_vget a fresh LOCKED vp) is skipped; error = 0; — execution continues with the unlocked vp.
• nfs_serv.c:599-604 (vput(vp) on mount mismatch) or nfs_serv.c:643 (vput(vp) after VFS_VPTOFH/VOP_GETATTR) — vput() on the unlocked vnode.
• sys/kern/vfs_lock.c:703-707 — vput() = vn_unlock() + vrele(); sys/kern/vfs_vnops.c:1125-1128 — vn_unlock() = lockmgr(LK_RELEASE).
• sys/kern/kern_lock.c:767-768 — LK_RELEASE on an unheld lock panics unconditionally: panic("lockmgr: LK_RELEASE: no lock held").

Exploit chain

n/a (remote pre-auth panic/DoS). The public filehandle is by definition the unauthenticated entry point; no valid fh or credential is required, only an export configured with -public and index=<file> and network reachability (reserved source port when vfs.nfs.nfs_privport=1).

Fix validation

fix.diff re-locks the vp (vn_lock LK_EXCLUSIVE|LK_RETRY) when the index lookup fails, restoring the locked-vnode invariant expected by the rest of the function. Validated on a rebuilt kernel: the identical LOOKUP(public fh, "/") now returns a normal reply and the guest stays up (see run.fixed.log).