DF-3055 — evidence pack

Finding: dirfs_nsymlink/nmkdir run the success path when dirfs_alloc_file fails: dirfs_knote(NULL) SIGSEGV, negative-cache of an existing name, error clobbered by stale errno

Verdict: REPRODUCED (deterministic two-TU harness; dirfs is vkernel-only). Impact: vkernel crash (racy create/remove trigger) + persistent namecache inconsistency + errno clobber (incl. fake success).

Reproduce

./build.sh   # cc -O2 -Wall -o harness harness.c knote.c
./run.sh     # expect BUG CONFIRMED + FIX VALIDATED; rc=2

See VERDICT.md for the full narrative; manifest.json / verdict.json for machine-readable results.

DF-3055 — dirfs_nsymlink/dirfs_nmkdir execute the SUCCESS path when dirfs_alloc_file() fails: dirfs_knote(NULL) crash, negative-cache of an existing name, error clobbered by stale errno

Verdict

REPRODUCED (deterministic harness, 3/3 runs identical) — when dirfs_alloc_file() fails after the host symlink()/mkdirat() succeeded, dirfs_nsymlink still executes its success block:

:1194  error = dirfs_alloc_file(dmp, &dnp, pdnp, ncp, vpp, NULL, 0);
:1196  if (error)
:1197          error = errno;              /* real error clobbered by STALE errno */
:1198  cache_setunresolved(ap->a_nch);
:1199  cache_setvp(ap->a_nch, *vpp);       /* *vpp == NULL -> negative entry for an EXISTING name */
:1200  dirfs_knote(*vpp, NOTE_WRITE);      /* NULL deref -> KNOTE(&NULL->v_pollinfo...) */

kern_symlink() initializes vp = NULL before VOP_NSYMLINK and dirfs_alloc_file only assigns *vpp on success (subr.c:212-213), so *vpp is NULL on every failure path (openat failure subr.c:196-199, stat failure subr.c:202-210). dirfs_knote() computes &vp->v_pollinfo.vpi_kqinfo.ki_note and KNOTE (sys/sys/event.h:168) dereferences the list head — a NULL-pointer dereference (SIGSEGV/panic). The harness proves it with a two-TU transcription (the KNOTE machinery in a separate translation unit, mirroring dirfs_vnops.c vs kern_event.c; a single TU lets gcc8 fold the NULL away).

dirfs_nmkdir (vnops.c:1067-1073) has the same structure but its knote is on dvp (safe); it still executes cache_setvp(ap->a_nch, NULL) at :1072 and clobbers the error at :1070 — the kernel namecache negative-caches a name whose object EXISTS on the host, so subsequent lookups return ENOENT until the entry is invalidated, and mkdir reports a wrong (or 0 = success) error.

The errno clobber (proven)

:1196-1197 / :1070 replace the real dirfs_alloc_file error with the vkernel process's libc errno — which the LAST libc call did not set (the create succeeded; the failure was inside kern-level code). Harness output:

real alloc_file error=2 (ENOENT), stale errno=0  -> nsymlink returns 0 (SUCCESS despite failure!)
real alloc_file error=2 (ENOENT), stale errno=13 -> nsymlink returns 13
real alloc_file error=2 (ENOENT), stale errno=21 -> nsymlink returns 21

A stale errno of 0 turns a failed symlink() into a SUCCESS return with nothing created and a negative-cache entry — userland believes the symlink exists.

Reachability of the alloc_file failure

After symlink(ap->a_target, path) / mkdirat() succeed, alloc_file fails when its fstatat (dirfs_node_stat) fails — practically when the fresh object disappears in between, e.g. a concurrent same-uid process (another vkernel process, or the vkernel's host user outside the vkernel) unlinking in a loop; the window is findfd+fstatat but standard create/remove races win it. (The over-length-path case crashes earlier — that is DF-3054.)

Impact ceiling: vkernel crash (DoS) via the racy trigger + persistent namecache inconsistency; availability only.

Distinction from known findings

DF-0856 covers alloc_file's node/refcount LEAK on the openat error path — this finding is about what dirfs_vnops.c does AFTER the failure return (NULL deref / negative cache / errno clobber), not the leak.

Reproduction

ssh dfbsd-maxx
cd poc/DF-3055
./build.sh    # cc -O2 -Wall -o harness harness.c knote.c
./run.sh      # errno-clobber table + SIGSEGV in vulnerable variant; fixed variant survives

knote.c models the KNOTE/knote machinery with a volatile list head (gcc8 otherwise deletes the NULL deref as dead/UB code — documented in the harness comments; several iterations were needed to defeat gcc8's IPA constant-propagation + UB-DCE, see poc_changes in verdict.json).

Result (identical over 3 runs):

[nsymlink-vuln] child killed by SIGSEGV -- NULL DEREF at dirfs_knote(*vpp) CONFIRMED
[nsymlink-fixed] returned error=2        (real ENOENT propagated, no crash)

Fix validation

fix.diff gates the success blocks on error == 0 and drops the errno clobber (propagate the real error): git apply --check RC=0 on the local tree and guest /usr/src; compile-neutral (identical first compiler error patched vs unpatched in the vkernel64 env — fix_*.log); harness FIXED variant validates the behavior. Live boot: not_testable (dirfs vkernel-only).