DF-3195 — nfs_inactive/nfs_reclaim discriminate the n_un3 union (nf_silly vs nd_cook) by the runtime-mutable v_type → server-side VREG→VDIR retype turns a pending sillyrename into a cookie-list walk: mismatched/wild kfree(M_NFSDIROFF) chain → deterministic kernel panic (2/2)

What this is

struct nfsnode overlays struct sillyrename *nf_silly and LIST_HEAD(, nfsdmap) nd_cook in one union (n_un3, sys/vfs/nfs/nfsnode.h:130-133). nfs_inactive() and nfs_reclaim() pick which interpretation to use by testing vp->v_type:

/* nfs_inactive, sys/vfs/nfs/nfs_node.c:392-397 */
if (ap->a_vp->v_type != VDIR) {
        sp = np->n_sillyrename;
        np->n_sillyrename = NULL;
} else {
        sp = NULL;                  /* ← sillyrename flush SKIPPED */
}
...
/* nfs_reclaim, sys/vfs/nfs/nfs_node.c:466-473 */
if (vp->v_type == VDIR) {
        dp = np->n_cookies.lh_first;    /* ← walks sp as an nfsdmap list */
        while (dp) {
                dp2 = dp;
                dp = dp->ndm_list.le_next;
                kfree((caddr_t)dp2, M_NFSDIROFF);
        }
}

But v_type of a live NFS vnode is mutable at runtime: nfs_loadattrcache() applies any server-claimed ftype to an existing vnode (if (vp->v_type != vtyp) nfs_setvtype(vp, vtyp) …, sys/vfs/nfs/nfs_subs.c:723-724 — the DF-2998 retyping behavior). A malicious/compromised/spoofing server (AUTH_SYS over UDP has no integrity) can therefore retype a VREG node that carries a pending sillyrename to VDIR, after which the last close executes:

1. nfs_inactive(): v_type == VDIR → the struct sillyrename (allocated M_NFSREQ in nfs_sillyrename, sys/vfs/nfs/nfs_vnops.c:3015) is never flushed — sp, sp->s_cred (a crdup'd ucred) and the vref'd sp->s_dvp all leak.
2. NREMOVED is set → vrecycle → nfs_reclaim(): v_type == VDIR → the cookie teardown interprets the union: dp = np->n_cookies.lh_first is sp. Loop iteration 1: kfree(sp, M_NFSDIROFF) — an M_NFSREQ object freed as M_NFSDIROFF. Iteration 2: dp = *(void **)sp = sp->s_cred (a live struct ucred *) → kfree(ucred, M_NFSDIROFF). Iteration 3: dp = *(void **)ucred = {u_int cr_ref = 1; padding} ≈ 0x1 → movq (%rdi),%r12 page-faults at 0x1 → panic (nfs_reclaim+0x150).

This is distinct from DF-2996 (vnops consuming an unchecked lookitup result): here every step up to the retype is honest — the sillyrename is validly stored on the correct node, and the DF-2996 vnops fix (validating the lookitup result and its type) does not prevent a later GETATTR from retyping the node. The defect is purely the union discrimination by mutable type in nfs_node.c.

Trigger: any unprivileged local user unlink()ing an open file on a mounted NFS share whose server then answers any attribute-bearing RPC for that file with directory-typed attributes.

PoC files

• fakesrv_retype.c — DF-2996's fake NFSv3 server + a retype mode: everything honest (CREATE/RENAME/LOOKUP all truthful, the silly-rename LOOKUP replies the file's own fh with honest REG attrs), EXCEPT GETATTR(fh_file) replies DIR-typed attributes once the silly-rename completed (the "late retype").
• trigger_retype.c — open(O_CREAT) + unlink() (valid sp stored on the VREG node) → sleep 16 s (attr-cache expiry) → fstat(fd) (RPC GETATTR → live retype, printed as type = DIRECTORY) → close(fd) (VREF_FINALIZE → VOP_INACTIVE → vrecycle → VOP_RECLAIM → wild walk).

Build (in-guest)

cd /root/df3195
cc -O2 -o fakesrv_retype fakesrv_retype.c
cc -O2 -o trigger_retype trigger_retype.c

Run (baseline, stock kernel)

(./fakesrv_retype retype > /dev/console 2>&1 &)
sleep 1
mount_nfs -o port=2049,udp 127.0.0.1:/P /mnt
rm -f /mnt/f
./trigger_retype > /dev/console 2>&1

Expected (baseline — verified 2/2, deterministic)

[1] open(/mnt/f) = fd 3
[2] unlink() = 0  (silly-rename pending: valid sp on VREG node)
[3] sleeping 16s for attr-cache expiry...
[4] fstat(fd): server-claimed type = DIRECTORY (live retype applied)
[5] close(fd) -> VOP_INACTIVE (sp flush skipped) + vrecycle -> VOP_RECLAIM ...
Fatal user address access from kernel mode from trigger_retype
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x1
Stopped at      nfs_reclaim+0x150:      movq    (%rdi),%r12

(the 0x1 is sp->s_cred's cr_ref=1 + padding read as the next nfsdmap * — after TWO wrong-object frees already executed: sp (M_NFSREQ) and the live ucred.)

Expected (with fix.diff)

The late GETATTR retype may still be applied (that's DF-2998's side), but nfs_inactive flushes the sillyrename regardless of the current type (NSILLY flag), the REMOVE RPC fires, and nfs_reclaim never walks the union as cookies: no panic, guest stays up, trigger prints [6] close() = 0. Verified on the rebuilt kernel (run.fixed.log).

Fix

fix.diff: add NSILLY (reusing the free NUNUSED040 bit) as the union discriminator — set at the sp store site, honored (and cleared) in nfs_inactive, checked in nfs_reclaim (cookie walk only when not NSILLY; unreachable safety-net free otherwise).

DF-3195 VERDICT — REPRODUCED (panic; deterministic; 2/2 baseline) — FIXED (validated on rebuilt kernel)

Bottom line

nfs_inactive() and nfs_reclaim() in sys/vfs/nfs/nfs_node.c decide how to interpret the n_un3 union of struct nfsnode (struct sillyrename *nf_silly vs LIST_HEAD(, nfsdmap) nd_cook, sys/vfs/nfs/nfsnode.h:130-133) by testing vp->v_type. The type of a live NFS vnode is mutable at runtime — nfs_loadattrcache() applies any server-claimed ftype to an existing vnode (nfs_setvtype, sys/vfs/nfs/nfs_subs.c:723-724; DF-2998's retyping behavior) — so a malicious server can flip a VREG node carrying a pending sillyrename to VDIR and the next reclaim executes the directory-cookie teardown on the sillyrename pointer: kfree(sp /* M_NFSREQ */, M_NFSDIROFF), then dp = sp->s_cred → kfree(live ucred, M_NFSDIROFF), then dp = *(void**)ucred = 0x1 (cr_ref=1+padding) → page fault at 0x1.

Reproduced: yes — deterministic, 2/2, stock INVARIANTS kernel. Impact: panic (with two wrong-object frees executed before the fault — a type-confused teardown in the memcorrupt family). Exploit ceiling: the first two frees are size-correct in DragonFly's slab allocator (block headers, not the malloc type, determine placement), so they are "only" type/accounting mismatches plus a premature free of a live ucred; the third dereference chases cr_ref-derived garbage (0x00000001) and faults. Pushing to uid=0 would require the first qword of a freed object in the walk to be attacker-shaped — s_cred's layout (cr_ref/padding) is not attacker-controlled — so uid0 escalation is not realistically reachable through THIS walk; the deterministic outcome is a remote-triggerable (server) / local-assisted (unpriv unlink) kernel panic.

How it was reproduced (baseline, stock kernel #0 Thu Jul 2 06:02:54)

(./fakesrv_retype retype > /dev/console 2>&1 &)     # loopback NFSv3 server
mount_nfs -o port=2049,udp 127.0.0.1:/P /mnt
./trigger_retype > /dev/console 2>&1

Console (full text in run.log / panic.txt):

[1] open(/mnt/f) = fd 3
[2] unlink() = 0  (silly-rename pending: valid sp on VREG node)
[3] sleeping 16s for attr-cache expiry...
[4] fstat(fd): server-claimed type = DIRECTORY (live retype applied)
[5] close(fd) -> VOP_INACTIVE (sp flush skipped) + vrecycle -> VOP_RECLAIM ...
Fatal user address access from kernel mode from trigger_retype
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x1
Stopped at      nfs_reclaim+0x150:      movq    (%rdi),%r12

Walk-through of the exact chain (every step source-verified):

1. unlink() of an open file → nfs_sillyrename() (sys/vfs/nfs/nfs_vnops.c:2992-3041): the rename RPC and the confirming nfs_lookitup(".nfsXXX") are answered HONESTLY by the server (mode retype = control mode for everything except the late GETATTR), so a perfectly valid sp (kmalloc'd M_NFSREQ at :3015, crdup'd s_cred, vref'd s_dvp) is stored: np->n_sillyrename = sp (:3040); NREMOVED + VREF_FINALIZE set (:2999-3002). Node is VREG. (This is what distinguishes DF-3195 from DF-2996: no unchecked lookitup result, no lying fh, no vnops bug involved at all.)
2. sleep(16) lets the attribute cache go stale; fstat(fd) → GETATTR RPC → server replies DIR-typed fattr for the file's own fh → nfs_loadattrcache → vp->v_type != vtyp → nfs_setvtype(vp, VDIR) (nfs_subs.c:723-724). Trigger prints [4] ... DIRECTORY.
3. close(fd) → 1→0 with VREF_FINALIZE → vnode_terminate() → VOP_INACTIVE → nfs_inactive (nfs_node.c:392): v_type == VDIR → sp flush SKIPPED → NREMOVED → vrecycle → vgone_vx → VOP_RECLAIM → nfs_reclaim (nfs_node.c:466): v_type == VDIR → dp = np->n_cookies.lh_first is sp → iter1: kfree(sp, M_NFSDIROFF); dp = sp->s_cred iter2: kfree(ucred, M_NFSDIROFF); dp = *(void**)ucred = 0x1 iter3: movq (%rdi),%r12 faults at 0x1 → panic at nfs_reclaim+0x150.

Two independent baseline runs panicked identically (run.log = capture run; first run same signature in the initial ssh session).

Fix validation (mandatory: memory-corruption class)

fix.diff (applied in-guest to /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC RC=0 — nfs_node.c compile confirmed in build log; make installkernel RC=0; rebooted into #1: Tue Sep 8 08:54:52 UTC 2026):

• adds NSILLY (reusing free flag bit NUNUSED040 0x0040) as the union discriminator: set at the sp store site (nfs_vnops.c:3041), honored and cleared in nfs_inactive (flush regardless of current type), checked in nfs_reclaim (cookie walk only when not NSILLY; safety-net free otherwise).

Baseline vs patched (identical PoC, mode retype):

The patched run still shows [4] ... DIRECTORY — i.e. the server-side retype (DF-2998, separate finding) is NOT what the fix blocks; the fix makes nfs_node.c's teardown immune to the type flip. fix_status: fixed.

Honesty notes

• An intermediate "fixed" run still panicked — root cause: the combined patch application silently failed (interactive patch --dry-run aborted the && chain), so that kernel contained only the DF-3194 hunks. The identical nfs_reclaim+0x150 offset across kernels exposed it. The final validation kernel had all hunks applied and verified by grep (NSILLY present in nfsnode.h / nfs_node.c / nfs_vnops.c) before build.
• The fake server's startup banner ("mode=err") is a stale print from the DF-2996 lineage; the actual mode logic is retype (proven by [4]).
• Requires a malicious/compromised NFS server (or an on-path spoofer — AUTH_SYS/UDP replies carry no integrity); the local-user part (open+unlink+fstat+close) is entirely unprivileged.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.