Mount/unmount error-path hygiene family: KTR_LOG reads freed dmp->dm_path after kfree, dirfs_root KTR prints uninitialized `error`, and mp->mnt_data is left dangling over freed dmp on failed mounts
Summary
(a) Both early-error paths free dmp (:131 copyinstr+copystr failure, :144 not-a-directory) and then 'goto failure' logs KTR_LOG(dirfs_mount, dmp->dm_path, ...) (:170) - a use-after-free read of the freed M_DIRFS chunk (contents flow into the root-only ktr buffer; only when dirfs tracing compiled in and enabled). (b) On the dm_root!=NULL branch of dirfs_root, 'error' is never assigned yet is passed to KTR_LOG (:276) - uninitialized stack read. (c) mp->mnt_data set at :123 before any validation and never cleared on the kfree paths - currently harmless (domount's failure path never touches mnt_data) but a latent trap. Defense-in-depth only. Fix: zero mnt_data before kfree, log before freeing, init error=0. [VERIFIED pass2: DEAD CODE per DF-3058; post-kfree KTR UAF read confirmed; hygiene fix authored]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3220 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 261 B | ↓ raw | |
| fix.diff | — | 1.6 KB | view raw | |
| manifest.json | — | 436 B | view raw | |
| verdict.json | — | 1.6 KB | view raw |
DF-3220 evidence pack
What
dirfs mount error paths: KTR uses freed dmp, uninit error, dangling mnt_data (dead code)
Verdict
status=not_reproduced impact=none confidence=certain
See VERDICT.md for the full narrative and fix.diff for the verified fix.
Fix verification
not_testabledirfs is dead code in this tree (no Makefile, absent from conf/files, vkernel-only) - fix.diff authored but not compilable in any configuration
Confirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff
PoC changes
n/a - dead code
Verified recommended fix
zero mnt_data before kfree; log before freeing or skip; pass 0 to dirfs_root KTR
Verdict
DEAD CODE - closed per the DF-3058 precedent (dirfs absent from conf/files, unbuildable, mount_dirfs vkernel-only). Line-accurate confirmation: both early-error paths kfree(dmp) then goto failure which logs KTR_LOG(dirfs_mount, dmp->dm_path, ...) - a use-after-free read into the root-only ktr buffer (dirfs_vfsops.c:131/144/170); dirfs_roots dm_root!=NULL branch passes an unassigned error to KTR_LOG (:276); mp->mnt_data is set at :123 before validation and never cleared on the free paths. Fix: clear mnt_data before kfree, skip the post-free log, pass 0 explicitly.
No comments yet.