⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-3088

nfssvc_nfsd() socket-zap race after the pipelined dorec leaks the request's mbuf chain and client address (:576-579 frees only the descriptor)

Summary

After processing a request, the loop re-arms via nfsrv_dorec() at :781 and - on success - releases slp->ns_token at :793 before re-acquiring at :554. In that window another nfsd on the same socket can nfsrv_zapsock() it (EPIPE on its own reply), clearing SLP_VALID. The re-acquiring nfsd then hits the ':575 guard' with a live nd and frees only the descriptor (kfree(nd) at :577) - nd->nd_mrep (up to NFS_MAXPACKET of mbufs) and nd->nd_nam2 (M_SONAME) never released, unlike RC_DROPIT/RC_REPLY paths. A remote unauthenticated NFS/TCP client that pipelines requests and resets the connection (driving concurrent EPIPE teardown on a sibling nfsd) can leak one mbuf chain + sockaddr per won race - slow kernel-memory exhaustion / DoS against a running NFS server. Narrow window; requires multiple nfsds. Not guest-verified (race; Low). Fix: free the full request in the :575 path matching RC_DROPIT. [VERIFIED pass2: 3000x16 pipelined SunRPC bursts plus SO_LINGER RSTs give identical netstat -m accounting - socket-zap window never won]

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-3088 · 8 files
FileTypeDescriptionSize
README.md — 321 B ↓ raw
VERDICT.md — 1.1 KB ↓ raw
df3088.c — 1.5 KB view raw
env.txt — 248 B view raw
fix.diff — 104 B view raw
manifest.json — 572 B view raw
run.log — 243 B view raw
verdict.json — 1.4 KB view raw
README.md
↓ download raw

DF-3088 - nfssvc_nfsd socket-zap race after pipelined dorec leaks request mbuf chain

Severity Low | verdict: not_reproduced | impact: none

Reproduce

Sources in this directory; build with cc -O2 -o <bin> <src> -pthread on the guest.

See VERDICT.md for the full narrative and run.log for the decisive output.

VERDICT.md
↓ download raw

DF-3088 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Attempted against the real kernel nfsd (rpcbind/mountd/nfsd running, tmpfs export): a malicious local TCP client sent 3,000 bursts of 16 pipelined SunRPC calls each, closing with SO_LINGER(1,0) to force RSTs. netstat -m accounting before/after is identical (7 mbufs in use, 263 data clusters, 0 denied/delayed) - the won-race leak window (:575-579 frees only the descriptor while nd_mrep/nd_nam2 stay allocated) was never crossed. Narrow window; no leak observed in this volume.

Kernel references

Fix

See fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

not_testable
↓ fix.diffper-fix-DF-3088

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md + run.log + sources

PoC changes

adjusted from finding sketch to guest syscall/layout reality

Verified recommended fix

diff: free nd->nd_mrep (m_freem) and nd->nd_nam2 in the :575 guard path, matching RC_DROPIT handling.

Verdict

Attempted against the real kernel nfsd (rpcbind/mountd/nfsd running, tmpfs export): a malicious local TCP client sent 3,000 bursts of 16 pipelined SunRPC calls each, closing with SO_LINGER(1,0) to force RSTs. netstat -m accounting before/after is identical (7 mbufs in use, 263 data clusters, 0 denied/delayed) - the won-race leak window (:575-579 frees only the descriptor while nd_mrep/nd_nam2 stay allocated) was never crossed. Narrow window; no leak observed in this volume.