DF-3134 — dirfs_node_setpassive() check-then-close of dn_fd races

dirfs_findfd()/consumer use: closed (and host-recycled) descriptor used

against the WRONG host file

What

Nothing in dirfs synchronizes dn_fd lifetime. dirfs_node_setpassive(dmp, dnp, 0) (dirfs_subr.c:848-857) checks dirfs_node_refcnt(dnp) == 2 && … and then close(dnp->dn_fd); dnp->dn_fd = DIRFS_NOFD; — while another CPU can be inside dirfs_findfd() (walk reads dnp1->dn_fd at :470, the node ref happens only afterwards at :486) or inside a consumer that uses pathnp->dn_fd after findfd returned (dirfs_alloc_file :194/:202, getattr vnops:391/:393, readlink vnops:1329, nremove's unlinkat vnops:909, nmkdir's mkdirat vnops:1051-1058, open_helper :602). If the close wins the race:

• without fd recycling: the consumer's openat/unlinkat/fstatat hits a closed descriptor → EBADF (and in dirfs_alloc_file the openat()==-1 path re-enters the DF-0856 node-leak error path);
• with fd recycling (the vkernel opens host files constantly): the consumer operates on whatever host file now owns that fd number — metadata and create/unlink operations land in the WRONG directory/file, bounded only by the vkernel process's host credentials.

Sibling of DF-3060 (which owns the unlocked dm_fdlist walk UAF in nresolve); this finding is the fd lifetime race with a different, worse failure mode (wrong-file operations via a recycled descriptor).

Reproduce

dirfs is vkernel-only → deterministic orchestrated transcription (DF-3054 precedent): verbatim findfd walk condition and setpassive close branch, real descriptors, real openat/fstatat/O_CREAT, three threads synchronized by step barriers reproducing the exact unsynchronized interleaving:

ssh dfbsd-maxx        # unprivileged (uid 1001)
cd poc/DF-3134
./build.sh && ./run.sh   # expect rc=2

Expected (run.log): * variant 1 — consumer used fd=4; setpassive closed it; recycler got fd=4; consumer's openat(stale_fd, "sentinel") read the DECOY directory's file; its O_CREAT created a file in the DECOY directory; the intended directory untouched; * variant 2 — no recycler: openat on the closed fd → EBADF (use-after-close); * variant 3 — FIXED (dm_token held across findfd..dropfd and across setpassive's check+close): consumer reads the CORRECT sentinel, creation lands in the intended directory, no EBADF.

3/3 runs byte-identical (run.log, run.2.log, run.3.log — same MD5).

Fix

fix.diff: lwkt_gettoken(&dmp->dm_token) in dirfs_findfd (released by dirfs_dropfd for non-NULL node arguments, i.e. exactly the findfd callers) and across setpassive's check+close section. LWKT tokens are reentrant per thread, so the nested acquisitions (nremove holds findfd's token when it calls setpassive; node_free→setpassive under dropfd) are safe. Applies cleanly (git apply --check RC=0 local + guest /usr/src), compile-neutral (identical first error, pre-existing errno.h env breakage). A full passive-cache lockdown belongs with DF-3060.

DF-3134 — setpassive check-then-close of dn_fd races findfd ref-then-use

Verdict

REPRODUCED (deterministic orchestrated harness, 3/3 runs byte-identical; real-world hit requires an SMP vkernel — the interleaving itself is proven possible because nothing synchronizes dn_fd) —

dirfs_node_setpassive(dmp, dnp, 0) (dirfs_subr.c:848-867) does a check-then-close of dn_fd:

:849   if (dirfs_node_refcnt(dnp) == 2 && vp && dnp->dn_fd != DIRFS_NOFD && …) {
:856       close(dnp->dn_fd);
:857       dnp->dn_fd = DIRFS_NOFD;
   }
:867   dirfs_node_drop(dmp, dnp);

while dirfs_findfd() (:470-496) walks the parent chain reading dnp1->dn_fd, takes the node reference only at :486 (dirfs_node_ref(dnp1)) — after the walk — and every consumer then uses pathnp->dn_fd after the function returned (alloc_file subr:194/:202, getattr vnops:391/:393, readlink vnops:1329, nremove unlinkat vnops:909, nmkdir mkdirat vnops:1051-1058, open_helper subr:602, strategy pread/pwrite vnops:819-822). No lock, token, or refcount ordering connects the two sides.

Orchestrated interleaving (verbatim branch conditions, real descriptors): T1 walks and captures use_fd = dn_fd; T2 checks refcnt==2 (T1 has not ref'd yet), close()s the descriptor and stores NOFD; T3 opens an unrelated decoy directory which — lowest-free — recycles the same fd number; T1 refs, returns, and the consumer's openat(use_fd, "sentinel") reads the decoy directory's sentinel and its O_CREAT creates a file inside the decoy directory. Without the recycler the consumer gets EBADF (use-after-close; in dirfs_alloc_file that error path is additionally the DF-0856 node leak).

Impact ceiling: cross-file metadata/create/unlink/data operations on the wrong host objects, bounded by the vkernel process's host credentials; otherwise EBADF storms. dirfs is vkernel-only (sys/platform/vkernel64/conf/files:45-47). Distinct mechanism from DF-3060 (unlocked dm_fdlist walk — list UAF/corruption): this is the fd lifetime check-then-close race with a recycled-descriptor wrong-file primitive.

Reproduction

1) consumer used fd=4; setpassive closed it; recycler got fd=4
   BUG 1a: host recycled the closed fd number to an unrelated open
   BUG 1b: openat(stale fd,"sentinel") read the DECOY directory's file
   BUG 1c: O_CREAT created a file in the DECOY directory
   (intended directory NOT touched)
2) BUG 2: openat on the closed fd -> EBADF (use-after-close)
3) FIXED: dm_token serializes findfd..dropfd against check+close
   consumer read the CORRECT sentinel; creation landed in the intended dir
   → exit code 2; 3/3 identical runs

Fix validation

• fix.diff — lwkt_gettoken(&dmp->dm_token) in dirfs_findfd (token held until dirfs_dropfd for non-NULL node args = exactly the findfd callers; the cur == NULL and over-length exits release it), plus the same token across setpassive's check+close section. LWKT tokens are per-thread reentrant, so nested acquisition (nremove's setpassive under findfd's token; node_free→setpassive under dropfd) is safe. git apply --check RC=0 on the local sys/ tree and the guest /usr/src.
• Compile-neutral: identical first error vs baseline in the vkernel64 ad-hoc env (pre-existing errno.h breakage; fix_base_cc.log vs fix_patched_cc.log).
• Behavior: harness FIXED variant shows correct-file access, no wrong-file creation, no EBADF.
• Live boot: not_testable (dirfs vkernel-only; no vkernel boot on this guest — same as DF-3054). The full passive-cache lockdown (nresolve's unlocked fdlist walk) belongs to DF-3060.

How to reproduce

ssh dfbsd-maxx   # unprivileged (uid 1001)
cd poc/DF-3134
./build.sh && ./run.sh     # expect: rc=2 "RACE CONFIRMED + FIX VALIDATED"

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.