devfs_fo_stat dereferences DEVFS_NODE(vp)->d_dev without the NULL guard getattr has → NULL-deref panic when the device node was torn down under an open fd
| Field | Value |
|---|---|
| ID | DF-3021 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-476 |
| File | sys/vfs/devfs/devfs_vnops.c |
| Lines | 1432 (guard contrast :565) |
| Area | vfs/devfs |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | memcorrupt |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
devfs_vop_getattr guards 'if (node == NULL) return EIO' because devfs_freep NULLs vp->v_data on device destruction; devfs_fo_stat calls vn_stat (→getattr, guarded) and then unconditionally does sb->st_rdev = devid_from_dev(DEVFS_NODE(vp)->d_dev) at :1432 — a detach racing between the getattr and :1432 NULL-derefs. Needs a device destroyed while an fd is open (revoke/driver detach — root-mediated; pty protocol blocks the unpriv variant), then fstat(fd) races the detach → panic. Not executed (root pre-condition); direct code-path. Fix: cache node once at fo_stat entry and guard, or take the vp lock around the stat critical section.
Timeline
- 2026-09-02 Discovered during pass-2 audit of devfs_vnops.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3021 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 299 B | ↓ raw | |
| VERDICT.md | — | 1.1 KB | ↓ raw | |
| env.txt | — | 248 B | view raw | |
| fix.diff | — | 156 B | view raw | |
| manifest.json | — | 555 B | view raw | |
| run.log | — | 145 B | view raw | |
| verdict.json | — | 1.3 KB | view raw |
DF-3021 - devfs_fo_stat dereferences DEVFS_NODE(vp)->d_dev without the NULL guard getattr has
Severity Low | verdict: not_reproduced | impact: none
Reproduce
No runnable PoC on this rig (see VERDICT.md for why).
See VERDICT.md for the full narrative and run.log for the decisive output.
DF-3021 verification
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Not exercised: triggering needs a device destroyed under an open fd (root-mediated revoke/driver detach), then fstat(fd) racing the detach. Line-verified: devfs_fo_stat calls vn_stat (guarded getattr) then unconditionally executes sb->st_rdev = devid_from_dev(DEVFS_NODE(vp)->d_dev) at devfs_vnops.c:1432, while devfs_vop_getattr carries an explicit node==NULL EIO guard at :565. Certain-by-inspection NULL-deref window; unreachable without a root-triggered destroy race on this rig.
Kernel references
Fix
See fix.diff.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md + run.log + sources
PoC changes
none
Verified recommended fix
diff: cache node = DEVFS_NODE(vp) once at fo_stat entry and return EIO when NULL (mirroring getattr), or hold vp locked across the stat critical section.
Verdict
Not exercised: triggering needs a device destroyed under an open fd (root-mediated revoke/driver detach), then fstat(fd) racing the detach. Line-verified: devfs_fo_stat calls vn_stat (guarded getattr) then unconditionally executes sb->st_rdev = devid_from_dev(DEVFS_NODE(vp)->d_dev) at devfs_vnops.c:1432, while devfs_vop_getattr carries an explicit node==NULL EIO guard at :565. Certain-by-inspection NULL-deref window; unreachable without a root-triggered destroy race on this rig.
No comments yet.