DF-3250 — ext2_alloc_vnode EBUSY-collision handler double-frees the inode (UAF/double-free + permanent-hang DoS)

Impact: kernel heap double-free / use-after-free, unprivileged-triggerable race; deterministic panic on the double free; lost-wakeup sibling flaw wedges syscalls permanently. Verified on the stock INVARIANTS guest kernel (panic), fix-validated (same race, no panic).

What

ext2_alloc_vnode() (sys/vfs/ext2fs/ext2_vfsops.c:1262) publishes vp->v_data = ip at :1297 before the duplicate-detecting hash insert ext2_ihashins(ip) at :1313. When the insert returns EBUSY the handler (:1313-1320) does:

vp->v_type = VBAD;
vx_put(vp);              /* VBAD => VREF_FINALIZE => SYNCHRONOUS reclaim:
                            ext2_reclaim() frees ip (ext2_inode.c:569) */
free(ip, M_EXT2NODE);    /* second free of the same chunk => double free */

vx_put() on a VBAD vnode with refcount 1 sets VREF_FINALIZE (sys/kern/vfs_lock.c:763-764), vreile() finalizes synchronously, ext2_inactive() sees i_mode == 0 → vrecycle() (ext2_inode.c:527-528) → vgone_vxlocked() → ext2_reclaim() → free(ip) [#1] — all inside the vx_put() call. Control returns to the handler which executes free(ip) [#2]. The slab allocator's free-chunk check panics:

panic: memory chunk 0xfffff80119113620 is already free!
 _kfree() <- ext2_alloc_vnode() <- ext2_vget() <- ext2_fhtovp()

Additionally, because v_data is set, the reclaim path also executes vrele(ip->i_devvp) — which is the macro i_ump->um_devvp (sys/vfs/ext2fs/inode.h:174) — without any matching vref() (the matching vref happens only on the success path at ext2_vfsops.c:1415). Each hit also drops one reference off the mounted device vnode.

Why the loser reaches the EBUSY branch (no instruction-level race needed)

The ad-hoc serializer ext2fs_inode_hash_lock (ext2_vfsops.c:1275-1282) does not cover the ext2_ihashget() miss that precedes it in ext2_vget() (:1350). A thread whose hash miss predates the winner's insert but whose lock check postdates the winner's unlock (:1325) enters ext2_alloc_vnode(), runs malloc + getnewvnode + ext2_ihashins, finds the winner's entry and gets EBUSY — through ordinary SMP scheduling (the loser's [ihashget-miss → lock-check] gap must straddle the winner's insert→unlock moment, a ~1µs door per cold-inode create episode). The check-then-set on the plain int is also non-atomic.

The same broken lock has a second defect observed live during reproduction: the wakeup protocol (if (lock < 0) wakeup(); lock = 0) races a sleeper setting lock = -1 between the check and the store — the sleeper's tsleep(..., "e2vget", ...) has no PCATCH and nobody ever wakes it: the syscall thread hangs permanently in D-state (observed: parent process of the PoC pair wedged forever; unkillable).

Reproduction (verified)

• Driver fh_race.c: two CPU-pinned processes barrier-synchronize and fhopen() the same (cold) ext2 inode — fhopen → ext2_fhtovp → ext2_vget directly, no namei smear. One side sweeps a 0..250µs per-round offset; a supervisor respawns the pair when the lost-wakeup flaw wedges one side. Cold supply: kern.maxvnodes=1200 forces vnlru reclaim of the 6000 hardlinked target inodes (an inode whose vnode sits free-listed is still ihash-findable; only VOP_RECLAIM makes it cold).
• Baseline (instrumented stock module, counters only): panic after 32,757 raced cold creations (ins=32757 ebusy=1), see panic.txt: DF3250[ihash]: EBUSY! dev=... ino=30751 then the double-free panic with _kfree <- ext2_alloc_vnode <- ext2_vget <- ext2_fhtovp.
• Fix validation (same module + fix.diff, same race, 2 pairs, ≥4 min): 662,865 cold creations, 2,515 lock-contention pairings, guest alive, no panic — and the post-fix run continues until an EBUSY fires without harm (counters watched live).

Files

• fh_race.c — race driver (fhopen-based, final)
• race_e2.c — earlier open()-based two-directory driver (kept for the unprivileged narrative; same kernel path via namei)
• reload.c — MNT_RELOAD purge tool (cold-supply alternative)
• instrument.diff — printf/counter probes added to the module
• modsrc.tgz is NOT included; instrument.diff + fix.diff regenerate it
• fix.diff — the verified minimal fix
• panic.txt — baseline panic (console)
• build.sh / run.sh — exact commands
• env.txt — guest environment

Threat model

Unprivileged local user racing open()/stat of the same ext2 file (see race_e2.c — two hardlinks in two directories avoid the parent-dir lock serialization). Trigger rate measured: 1 EBUSY per ~33k cold-inode race pairs (~30-120s of hammering on the stock guest). Also reachable through any path that drives VFS_VGET (NFS READDIRPLUS/file handles, fhopen, namei). Root required only for the harness conveniences (pin/fhopen/mount), not for the vulnerability class.

Severity: High (kernel heap double-free; on non-checking builds the same sequence is exploitable heap corruption — freed chunk re-handed to the magazine while a freelist vnode still points at it; plus the permanent syscall-hang DoS).

DF-3250 VERDICT

reproduced — unprivileged-class kernel heap double-free (use-after-free family) triggered by racing concurrent ext2 inode instantiations; verified as an instant, deterministic panic on the stock INVARIANTS guest kernel, then fix-validated: with fix.diff applied to the ext2fs module the exact same race fired the same EBUSY collision branch and the guest survived.

Mechanism (path:line, all verified on the guest)

1. ext2_alloc_vnode() (sys/vfs/ext2fs/ext2_vfsops.c:1262) sets vp->v_data = ip at :1297, before ext2_ihashins(ip) at :1313 (inverted w.r.t. the safe ffs_vget() ordering, ffs_vfsops.c:1120-1129, which assigns vp->v_data only after a successful insert).
2. ext2fs_inode_hash_lock (:1275-1282) does not cover the ext2_ihashget() miss in ext2_vget() (:1350) and its check-then-set on a plain int is non-atomic, so two threads can both run the creator path for the same (dev, ino); the token inside ext2_ihashins (ext2_ihash.c:131) detects the duplicate and returns EBUSY — no instruction-level race is needed to get here, only a loser whose [hash-miss → lock-check] gap straddles the winner's insert→unlock.
3. The EBUSY handler (:1313-1320) executes vp->v_type = VBAD; vx_put(vp); free(ip, M_EXT2NODE);. vx_put() on a VBAD last-ref vnode sets VREF_FINALIZE (sys/kern/vfs_lock.c:763-764); vreile() finalizes synchronously; ext2_inactive() sees i_mode == 0 → vrecycle() (ext2_inode.c:527-528) → vgone_vxlocked() → ext2_reclaim() → free(ip, M_EXT2NODE) (ext2_inode.c:569) — the first free, inside the vx_put() call. Return to the handler → free(ip) — the second free → slab free-chunk check panics.
4. Because v_data was published, ext2_reclaim() also runs vrele(ip->i_devvp) — the macro i_ump->um_devvp (sys/vfs/ext2fs/inode.h:174) — with no matching vref() (that only happens on success at ext2_vfsops.c:1415): each hit also steals a reference from the mounted device vnode.

Sibling defect (same broken lock, observed live): the wakeup protocol if (lock < 0) wakeup(); lock = 0; (:1323-1325) races a sleeper setting lock = -1 between the check and the store → lost wakeup → the sleeper's non-PCATCH tsleep(..., "e2vget", ...) blocks forever (permanent D-state syscall hang, unkillable). Encountered repeatedly during PoC operation; the driver/supervisor handle it by stall-detection + respawn.

Run log

The A/B on runs 4 vs 5 (same instrumentation, only fix.diff differing) is the fix validation: the identical triggering event panics before and is handled after.

Exploitability notes

• On the stock kernel the double free is caught by the slab allocator's free-chunk check (panic). On configurations without that check the sequence is a classic exploitable double free: the chunk returns to the magazine while the reclaimed vnode's free-list state briefly referenced it; a second allocation hands the same address to a different type while ext2_reclaim's ip walks (i_flag/IN_HASHED/i_devvp macro deref) still apply to the loser's ordering. The additional unbalanced vrele(um_devvp) enables a premature device-vnode death under repeat.
• The lost-wakeup hang is itself an unprivileged DoS (permanent, system grows D-state threads; each wedged thread is unkillable).
• Reachability without root: any two concurrent lookups of the same not-in-cache ext2 file (open/stat via two hardlinked names avoids the parent-dir lock serialization — race_e2.c). NFS READDIRPLUS/filehandle paths drive the same VFS_VGET.
• Measured trigger rate: 1 EBUSY per ~33k (baseline) / ~830k (fix run, luck-dependent) raced cold-inode creations — minutes of hammering with the provided harness on the 6-vCPU guest.

Bottom line

High-severity kernel memory-corruption bug (double free / UAF family) with a verified unprivileged-class trigger, deterministic panic, live-observed permanent-hang sibling flaw, and a one-line-ordering fix validated A/B on the same guest. Recommended upstream: apply the ordering fix (fix.diff), and additionally replace the hand-rolled ext2fs_inode_hash_lock protocol with atomics or fold serialization into the existing ext2_ihash_token (closes the lost-wakeup hang and the non-atomic check-then-set).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.