DF-3225 — procfs ATTACH lacks the ptrace tracer-cycle check → p_pptr cycle → unbounded kernel ancestor walk (permanent livelock)

File: sys/vfs/procfs/procfs_ctl.c:134-159 (procfs_control, PROCFS_CTL_ATTACH) Severity: Medium (unprivileged local DoS, permanent, progressive whole-system wedge) Status: REPRODUCED on DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, INVARIANTS, 6 vCPU).

What the bug is

ptrace(PT_ATTACH) refuses to attach to any ancestor of the caller when the caller is itself traced — this prevents tracer cycles:

if (curp->p_flags & P_TRACED)
    for (pp = curp->p_pptr; pp != NULL; pp = pp->p_pptr)
        if (pp == p) { ... return (EINVAL); }   /* sys_process.c:193-199 */

procfs's equivalent attach (write("attach\n", "/proc/<pid>/ctl")) has no such check (procfs_ctl.c:134-159 checks only P_TRACED-already, self, and CHECKIO/p_trespass). The ctl writer becomes the victim's parent (proc_reparent(p, curp), procfs_ctl.c:155). Two cooperating unprivileged same-uid processes can therefore attach each other:

A --ctl "attach"--> B   : B.p_pptr = A   (B stopped, then A runs B)
B --ctl "attach"--> A   : A.p_pptr = B   => parent-cycle A <-> B

Both remain P_TRACED and runnable (run via ctl "run"; note B must arm SA_NOCLDSTOP first — see PoC comment — or the SIGCHLD emitted when A completes its stop stops B, since B is traced by A).

With the cycle in place, the very check ptrace has becomes the weapon: ptrace(PT_ATTACH, <any untraced pid C>) from A (or B) walks pp = curp->p_pptr forever — A.p_pptr = B, B.p_pptr = A, pp != NULL always, pp == p (C) never. The walk spins inside the kernel holding C's p_token (taken at sys_process.c:162), unkillable (SIGKILL pends, never delivered), and every subsequent kernel operation that needs C's token — or touches the poisoned parent topology — wedges another CPU: kill(C) from another process, sshd session setup, etc. No panic; a progressive, permanent livelock from a plain unprivileged user.

Reproduced evidence (run.log)

[main] A=856 B=855 C=854
[A 856] attaching B (855)
[A] running B
[B 855] attaching A (856) back -> cycle
[B] running A again
[main] B reported cycle complete
[main] go marker set; A enters ptrace walk
[A 856] ptrace(PT_ATTACH, 854): if vulnerable, never returns
[main] after 5s: kill -9 A (856)
[main] A SURVIVED SIGKILL -> stuck in kernel spin
[main] now kill -9 C (854): needs C.p_token held by spinning A -- expect HANG
<no further output — kill(C) never returned>

• final line [main] kill(C) returned never printed (runner hung in kill(2));
• guest ssh became unavailable (banner timeouts) while the console showed no panic (wedge_evidence.txt);
• host-side qemu CPU pinned at 300-393% (3-4 of 6 vCPUs spinning in-kernel) with the guest otherwise idle — classic livelock, not load;
• guest required vm.sh reset — unkillable, unrecoverable.

Files

• df3225.c — PoC (unprivileged; builds the cycle, triggers the walk, proves unkillability + wedge spread)
• run.log — decisive run (direct output until ssh died)
• wedge_evidence.txt — host-side qemu CPU + ssh probe transcripts
• boot.log — serial console (no panic; guest alive-but-dead)
• fix.diff — verified fix (ancestor check mirroring sys_process.c:193-199)
• verdict.json, manifest.json

Build & run

cc -O -o df3225 df3225.c
./df3225          # WARNING: wedges the machine; expect to hard-reset after

DF-3225 VERDICT — REPRODUCED (permanent unprivileged kernel livelock / local DoS)

Bottom line

procfs_control(ATTACH) (sys/vfs/procfs/procfs_ctl.c:134-159) omits the tracer-cycle (ancestor) check that ptrace(PT_ATTACH) performs at sys/kern/sys_process.c:193-199. Because the ctl writer becomes the victim's parent (proc_reparent(p, curp), procfs_ctl.c:155), two cooperating unprivileged same-uid processes attach each other and create a p_pptr cycle. The ptrace ancestor walk

for (pp = curp->p_pptr; pp != NULL; pp = pp->p_pptr)   /* sys_process.c:194 */

then never terminates for any subsequent ptrace(PT_ATTACH, x) from either of them: the loop spins in-kernel holding the target's p_token (acquired at sys_process.c:162), the thread cannot be killed (SIGKILL pends on a thread that never returns to user mode), and the wedge spreads — each later kernel operation needing that token or touching the cyclic parent topology (kill(2) of the token-holder's target, sshd session setup) blocks or spins another CPU.

What was observed (run.log, 2026-09-08, DF 6.5-DEVELOPMENT #0)

1. Cycle built with three unpriv (uid 1001) forks + four ctl writes — all markers printed up to [B] running A again / [main] B reported cycle complete.
2. A ptrace(PT_ATTACH, C) never returned ([A] ... if vulnerable, never returns is the last A line).
3. kill -9 A had no effect (A SURVIVED SIGKILL -> stuck in kernel spin) — unkillable in-kernel thread.
4. kill -9 C from the runner never returned (the expected [main] kill(C) returned line is absent) — C's p_token is held forever by the spinner (kern_sig.c:802 blocks in lwkt_gettoken_shared).
5. Guest sshd stopped accepting connections (banner timeouts, multiple probes) while the serial console showed no panic — the system was alive-but-dead; host-side qemu burned 300-393% CPU (3-4 vCPUs pinned in-kernel) with the guest idle.
6. Only a hard reset recovered the machine.

Orchestration note: the PoC arms SA_NOCLDSTOP in B before attaching back — without it, the SIGCHLD emitted when A completes its attach-stop (kern_sig.c:1637 ksignal(p->p_pptr, SIGCHLD)) stops B (B is traced by A) and the two merely freeze each other (mutual-stop, observed in the first attempt, run.log.first-attempt not kept) without reaching the livelock.

Exploit chain (DoS)

fork A,B,C (unpriv) → A: ctl attach+run B → B: ctl attach+run A (cycle) → A: ptrace(PT_ATTACH, C) → kernel spins forever on one CPU holding C.p_token → any further activity touching C or the A/B parent topology wedges more CPUs → system unusable; no recovery without reboot. 100% reliable on the test guest.

Fix

fix.diff adds the missing ancestor check to procfs ATTACH, mirroring sys_process.c:193-199. Validated by patched-kernel rebuild + re-run (verdict.json fix_status): the attach-back is refused with EINVAL, the cycle never forms, ptrace(PT_ATTACH, C) returns normally, the runner completes, no wedge.

kernel_refs

• sys/vfs/procfs/procfs_ctl.c:134-159 (attach, no cycle check)
• sys/vfs/procfs/procfs_ctl.c:155 (proc_reparent(p, curp) — writer becomes parent)
• sys/kern/sys_process.c:162 (target p_token held during request)
• sys/kern/sys_process.c:193-199 (the unbounded walk)
• sys/kern/kern_sig.c:802 (kill blocks on p_token — wedge spread)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.