DF-2997 — PoC evidence pack

nfs_lookup/nfs_mkdir error paths vrele() vnodes that nfs_nget returned LK_EXCLUSIVE-locked — permanent vnode-lock leak; unkillable processes, wedged recycler (vnlru), unreclaimable vnode growth from malformed NFS server replies.

What is in here

How to reproduce (baseline, stock kernel)

dfbsd-qemu/vm.sh reset with-src
sh push.sh
dfbsd-qemu/vm.sh run_root 'cd /root/df2997 && sh build.sh && sh run.sh > run.raw 2>&1'

Expected (stock): every malicious trigger fails fast with errno=72 (RPC struct is bad); debug.numvnodes climbs permanently (599→672, zero reclaim after 20s); the SECOND syscall on a leaked name hangs in D2 state, wchan vnode, immune to kill -9; umount -f and even mount (listing) wedge in D-state; after sysctl kern.maxvnodes=<85% of numvnodes> the vnlru kernel thread wedges (B5 vnode vnlru) and innocent processes (cron) wedge at exit. The only recovery is a reboot.

How to reproduce (fix validation)

# apply fix.diff to the guest /usr/src copy (NOT to the audit tree)
dfbsd-qemu/vm.sh run_root 'cd /usr/src && git apply /root/df2997/fix.diff'
dfbsd-qemu/vm.sh run_root 'cd /usr/src && make nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC'
# reboot, then:
dfbsd-qemu/vm.sh run_root 'cd /root/df2997 && sh run_fixed2.sh > run_fixed2.raw 2>&1'

Expected (patched): identical control behavior; the same errno=72 errors (protocol behavior unchanged); repeat syscalls FAIL FAST and the processes exit (no D-state); vnodes are reclaimed (665→629→481); vnlru stays vlruwt under the same pressure; cron survives. The final umount -f of the still-poisoned mount panics with unmount: dangling vnode — a PRE-EXISTING latent defect (vmntvnodescan skips VNON vnodes, sys/kern/vfs_mount.c:931/:978), independently reproduced on the STOCK kernel via run_stocknod.sh through the stock nfs_mknodrpc error path that already vput()s. On the stock kernel the same umount does not even get that far: it hangs forever on the wedged vnode locks.

Attack preconditions (honest)

The trigger requires the client kernel to accept NFS replies from an attacker: a malicious/compromised NFS server, an on-path UDP spoofer (NFSv3/UDP + AUTH_SYS provides no integrity), or an unprivileged local user on a client that mounts attacker-influenced exports. The mount itself must exist (root/automount). Every trigger syscall runs as an unprivileged user (uid 1001 in the demo).

DF-2997 VERDICT — nfs_lookup/nfs_mkdir error paths vrele() LK_EXCLUSIVE-locked vnodes → permanent vnode-lock leak → unkillable processes, wedged vnlru, unreclaimable vnode growth (DoS); fix validated

Status: REPRODUCED — impact: dos (no privilege escalation; hang-class). Fix validated on a rebuilt kernel: leak, wedge, unkillability, recycler wedge and non-reclamation all eliminated; honest-server behavior identical. One pre-existing, separate latent defect (VNON vnodes skipped by vflush → umount -f panic) was unmasked and independently proven to exist on the stock kernel; it is NOT introduced by the fix (stock hangs at the same point instead of panicking — strictly worse).

Root cause (line-accurate)

nfs_nget() returns every vnode LK_EXCLUSIVE-locked with a reference held: - hash-hit path: vget(vp, LK_EXCLUSIVE) — sys/vfs/nfs/nfs_node.c:129; - fresh path: getnewvnode() (VX-locked) then vx_downgrade(vp) — sys/vfs/nfs/nfs_node.c:163,216.

Leak site 1 — nfs_lookup. For a LOOKUP reply that carries a valid filehandle followed by truncated/garbage post-op attributes: - nfsm_getfh() succeeds — sys/vfs/nfs/nfs_vnops.c:1175; - nfs_nget() creates the vnode — sys/vfs/nfs/nfs_vnops.c:1238, and newvp = NFSTOV(np) — :1249 (locked); - ERROROUT(nfsm_postop_attr(&info, newvp, ...)) fails — :1251-1253; nfsm_postop_attr → nfsm_dissect returns NULL on short data → EBADRPC (sys/vfs/nfs/nfsm_subs.c:493-495, 287-324); - nfsmout: tail drops it with vrele(newvp) — sys/vfs/nfs/nfs_vnops.c:1269-1274. The exclusive lock is never released.

Leak site 2 — nfs_mkdir. For a MKDIR reply [ok][fhfollow=1][fh] with nothing after the fh: - nfsm_mtofh() runs nfs_nget() and sets *vpp — sys/vfs/nfs/nfsm_subs.c:412,418 — then the attrs-bool dissect fails → EBADRPC — :421-423; - nfs_mkdir error tail: vrele(newvp) — sys/vfs/nfs/nfs_vnops.c:2359-2361; same for the (!error && !gotvp) kludge drop — :2346-2350.

Contrast (correct code already in-tree): nfs_nresolve releases with vput() (nvp == dvp ? vrele : vput) — sys/vfs/nfs/nfs_vnops.c:1083-1089; nfs_readdirplusrpc uses the same idiom — :2968-2974; nfs_lookitup — :3106-3124. Only the two old-API sites above are wrong.

Consequence chain (all demonstrated on the stock kernel)

1. The leaked vnode sits VS_ACTIVE with refcnt 0, exclusive lockmgr lock held forever (vrele 1→0 without FINALIZE — sys/kern/vfs_lock.c:345-396).
2. Any later reference to the same name/filehandle funnels into nfs_nget (hash-hit) → vget → vn_lock(vp, LK_EXCLUSIVE) — sys/kern/vfs_lock.c:589-592 — and sleeps forever with no PCATCH: the triggering process is unkillable (kill -9 ignored, state D2, wchan vnode). Demonstrated twice (probe PIDs 1448/1468).
3. The vnodes are permanently unreclaimable: debug.numvnodes 599→672 after 82 leaks and did not drop by one after 20s of idle (run.raw.baseline), while the same rig on the patched kernel reclaims them (665→629→481 under identical pressure).
4. The recycler wedges: cleanfreevnode() deactivate rover refs a 0-ref wedged vnode, sets VREF_FINALIZE, vrele() → finalize path → vx_lock(vp) blocks forever — sys/kern/vfs_lock.c:890-895 → :380-387. Demonstrated: after kern.maxvnodes 109306→575 the vnlru kernel thread went from B5 vlruwt vnlru to B5 vnode vnlru and never recovered (vnlru.after.baseline); the userexit-GC variant wedged an innocent cron daemon (D5Vs vnode, PID 1526) and every unwarmed command that exec'd under pressure.
5. Admin recovery is impossible without a reboot: umount -f of the poisoned mount wedges in D0 (PID 1484, wchan ncplk); even mount (listing mounts) wedges (PID 1488, wchan vnode).

Reproduction matrix (guest = DragonFly 6.5-DEVELOPMENT, INVARIANTS

X86_64_GENERIC; fake userland NFSv3/UDP server in-guest; triggers run as unprivileged uid 1001; mount setup by root — see preconditions)

The unmasked latent defect (follow-up, not DF-2997)

vmntvnodescan() skips v_type == VNON vnodes — sys/kern/vfs_mount.c:931 and :978 — so vflush() never processes never-attributed vnodes; they remain on mnt_nvnodelist and dounmount() panics (sys/kern/vfs_syscalls.c:1085-1086) once VFS_UNMOUNT reports success. Reachable on the stock kernel through the already-correct vput() error path of nfs_mknodrpc (sys/vfs/nfs/nfs_vnops.c:1655-1657) with a single truncated MKNOD reply (run_stocknod.raw + panic_stocknod.txt). On the stock kernel, DF-2997 masks this by wedging umount -f in an unkillable sleep even earlier. Recommended follow-up: make the VMSC_GETVX slow path (or vflush) handle VNON vnodes, or have the NFS error paths discard never-attributed vnodes with a full vx_lock/vgone_vxlocked/vx_unlock teardown instead of leaving them for the recycler.

Fix validated (fix.diff)

sys/vfs/nfs/nfs_vnops.c, three hunks, mirroring the in-tree idiom of nfs_nresolve:1083-1089 / nfs_readdirplusrpc:2968-2974: - nfs_lookup nfsmout: newvp == dvp ? vrele(newvp) : vput(newvp); - nfs_mkdir kludge drop (:2348): vput(newvp) (always nfs_nget-sourced); - nfs_mkdir error tail (:2361): newvp == dvp ? vrele : vput.

A/B results: patched kernel shows zero lock leaks, zero D-states, reclaimable vnodes, healthy vnlru and cron under the same pressure that wedged the stock kernel, and bit-identical honest-server behavior (control mount: mkdir/stat/touch/ls/umount all OK on both kernels). The EBADRPC errno=72 delivered to the triggering syscall is unchanged (correct: the reply really is malformed).

Impact ceiling (honest)

Denial of service only: unkillable local processes, per-name mount wedges, permanent kernel-memory/vnode growth, recycler-thread death, reboot-required recovery. No memory corruption, no info leak, no privilege escalation primitive. Precondition: attacker-controlled or spoofed NFS server replies (or an attacker-influenced export mounted by the client); triggering syscalls themselves run unprivileged. Matches the filed severity Medium, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.