dirfs_root lazy-init of dmp->dm_root is completely unlocked — concurrent VFS_ROOT creates two root nodes, leaks a dnp + host fd forever, and can produce a mount root vnode without VROOT
Summary
dirfs_root takes no dm_lock/dm_token (:231-269) while the VFS layer does not serialize VFS_ROOT. Two threads pathing through the mountpoint simultaneously both see dm_root==NULL and run the full init - including a slow host lstat syscall widening the window - and the second dm_root assignment (:250) overwrites the first. The loser's node is permanently leaked with its host fd open (its life-of-mount ref is orphaned; at unmount the fdlist setpassive brings it to refcnt 1 with vp==NULL and no closer fires), and the loser's root vnode is created without the VROOT flag (dirfs_alloc_vp checks dmp->dm_root == dnp), breaking namei's mount-root/'..' invariants; namecache ends up with two different vnodes for the mount root. Any two unprivileged vkernel users traversing the mount simultaneously on an SMP vkernel. Not Phase-V-verified (Low; SMP timing harness). Fix: serialize the lazy init or pre-create the root node at mount time. [VERIFIED pass2: not reproduced by construction - dirfs dead code; unlocked lazy-init line-certain]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3219 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | — | 778 B | view raw | |
| README.md | — | 385 B | ↓ raw | |
| VERDICT.md | — | 1.5 KB | ↓ raw | |
| build.sh | — | 117 B | view raw | |
| run.sh | — | 88 B | view raw | |
| manifest.json | — | 419 B | view raw | |
| verdict.json | — | 1.2 KB | view raw | |
| fix.diff | — | 778 B | view raw | |
| env.txt | — | 272 B | view raw |
DF-3219 -- verification pack
Finding: dirfs_root lazy-init unlocked; concurrent root creation leaks node+fd
Status: not_reproduced / impact denial_of_service / confidence likely
What was run
n/a (dead code)
How to reproduce
n/a
Expected
n/a
See VERDICT.md for the full narrative and verdict.json for the persisted machine verdict. Artifacts: fix.diff.
DF-3219 verification
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Bottom line
Not reproducible by construction: dirfs is dead code in this tree (DF-3058 precedent re-verified on this snapshot: no Makefile, absent from sys/conf/files, not loadable, and mount_dirfs refuses non-vkernel platforms). The defect is real in source: dirfs_root performs the dm_root lazy init completely unlocked (VFS_ROOT is not serialized by the VFS layer), so two concurrent path resolutions through the mountpoint both run the init, the loser leaks a dnp + host fd forever and can publish a root vnode without VROOT. Fix authored (serialize with dm_lock); compile validation impossible for dead code.
Kernel references
Exploit chain
(none: availability/correctness finding; no privilege chain)
Fix
serialize the lazy init with dm_lock
See fix.diff in this directory (git-apply-able against the read-only sys/ tree; applied only inside the disposable verification guest).
Reproduction
build: n/a (dead code)
run: n/a
expected: n/a
Notes on the PoC (what changed vs the finding sketch)
(none)
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md quoting DF-3058; source lines dirfs_vfsops.c:231-269
Verified recommended fix
serialize the lazy init with dm_lock
Verdict
Not reproducible by construction: dirfs is dead code in this tree (DF-3058 precedent re-verified on this snapshot: no Makefile, absent from sys/conf/files, not loadable, and mount_dirfs refuses non-vkernel platforms). The defect is real in source: dirfs_root performs the dm_root lazy init completely unlocked (VFS_ROOT is not serialized by the VFS layer), so two concurrent path resolutions through the mountpoint both run the init, the loser leaks a dnp + host fd forever and can publish a root vnode without VROOT. Fix authored (serialize with dm_lock); compile validation impossible for dead code.
No comments yet.