DF-3880 — use-after-free race in dsp_oss_syncstart() (SNDCTL_DSP_SYNCSTART)

File: sys/dev/sound/pcm/dsp.c:2992-3082 — pass 2 (GLM 5.3). Distinct from known DF-1263 (syncgroup error-path free without unlink).

BUILD scp syncstart_race.c dfbsd-maxx:/tmp/ vm.sh run_root 'cc -O2 -Wall -o /tmp/syncrace /tmp/syncstart_race.c -lpthread'

RUN (unprivileged, sound-equipped DragonFly box) vm.sh run_user '/tmp/syncrace; echo exit=$?'

EXPECTED This guest: open("/dev/dsp") -> ENOENT (no PCM device, env.txt); the race cannot execute here. On a sound-equipped box: two SYNCSTART threads racing on the same sg_id while a writer keeps the member channel lock contended force T1 into lksleep("pcmsg", 5ms) inside its member walk; T2 tears the group down (starts members, kfrees every sm and the sg, dsp.c:3056-3069) while T1 sleeps; T1's 5ms timeout wake resumes the SLIST_FOREACH from the freed sm — UAF read of SLIST_NEXT(sm) and CHN_TRYLOCK(sm->ch) on a freed object (wild lock pointer -> panic or corruption). 100k iterations in the PoC; a surviving run prints the "survived" line (race is probabilistic).

WHAT IT PROVES (source-certain) dsp.c:3042-3049: lksleep() drops snd_pcm_syncgroups_mtx while asleep, so sg/sm pointers held by the interrupted SLIST_FOREACH can be freed by a concurrent successful SYNCSTART; the timeout path (lksleep returns 0) does needlocks = 1; ret = 0; and CONTINUES the walk over freed memory. Only the EINTR/ERESTART path breaks out safely.

DF-3880 VERDICT — dsp_oss_syncstart use-after-free after lksleep

Status: not_reproduced (kernel path — no PCM device on this guest); source-certain mechanism; confidence likely (race timing analysis).

Root cause (dsp.c:3001-3051)

The SYNCSTART retry loop:

    PCM_SG_LOCK();                                   /* :3001 */
    do {
        SLIST_FOREACH(sg, &snd_pcm_syncgroups, link) { ... }   /* :3008 */
        SLIST_FOREACH(sm, &sg->members, link) {               /* :3027 */
            if (CHN_TRYLOCK(sm->ch) == 0) {               /* :3028 */
                /* unlock members locked so far */
                ret = lksleep(sm, &snd_pcm_syncgroups_mtx,
                    PCATCH, "pcmsg", timo);            /* :3042 */
                if (ret == EINTR || ret == ERESTART)
                    break;                         /* safe exit */
                needlocks = 1;
                ret = 0;                             /* :3048 */
            }
        }                                                  /* :3050 */
    } while (needlocks && ret == 0);                    /* :3051 */

lksleep(ident, lock, ...) releases snd_pcm_syncgroups_mtx while the thread sleeps. During that window (5 ms — timo = hz*5/1000, :3029-3031) another thread's successful SYNCSTART on the same sg_id:

• re-acquires the SG lock (free),
• locks ALL members (T1 just released M_0..M_{k-1}; M_k's lock is briefly free between writer-loop iterations),
• starts every member, SLIST_REMOVE_HEAD + kfrees every sm and SLIST_REMOVE + kfrees sg itself — dsp.c:3056-3069.

T1's plain timeout wake (lksleep returns 0, no signal) sets needlocks=1; ret=0 and the inner SLIST_FOREACH continues from the freed sm: SLIST_NEXT(sm, link) reads freed memory, then CHN_TRYLOCK(sm->ch) loads a freed-data channel pointer and takes an unbounded lockmgr path on it — kernel UAF (panic / exploitable corruption depending on heap reuse; kfreed M_DEVBUF chunk re-spray is an attacker activity). sg itself is also dangling during the resumed walk.

Trigger requirements

• PCM device present (SNDCTL_DSP_SYNCGROUP/SYNCSTART go through dsp_ioctl :2056-2066 with channels from getchns — /dev/dsp* are 0666).
• Force T1's trylock failure: keep the member channel's lock contended (the PoC's writer thread looping write(2) on the same channel — chn_write holds CHN lock between uiomove drops).
• T2 wins the race inside the 5 ms sleep — microseconds of work.
• No signal involved (signals take the safe EINTR break).

Not reproduced here

No PCM device on this guest (env.txt) — open("/dev/dsp") = ENOENT (run.log). The PoC is complete and would run verbatim on sound-equipped hardware; the mechanism is proven by source (lksleep lock-drop semantics + the free at :3056-3069 + the resume at :3050).

Fix

Break out of the stale walk after any sleep and let the do-while rescan from the list head (fix.diff, git-apply clean):

                needlocks = 1;
                ret = 0; /* Assumes ret == EAGAIN... */
+               /* DF-3880: lksleep() dropped the syncgroup
+                * lock; sg/sm may be freed now. Restart the
+                * scan instead of resuming the walk. */
+               break;
            }
        }

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.