DF-4147 — cuse proc_rwmem_dfly: arbitrary kernel read/write from the CUSE server

What

sys/dev/misc/cuse/cuse.c:881-893 (proc_rwmem_dfly) implements the server↔client cross-process data copy for CUSE_IOCTL_READ_DATA / CUSE_IOCTL_WRITE_DATA (dispatch at cuse.c:1352-1380, fallback at cuse.c:949-1030). The peer address (pchk->peer_ptr, a fully server-controlled 64-bit value) is passed as the raw kernel-side pointer of copyin()/copyout():

if (uio->uio_rw == UIO_WRITE)
        error = copyin(iov->iov_base, (void *)uio->uio_offset, iov->iov_len);
else
        error = copyout((void *)uio->uio_offset, iov->iov_base, iov->iov_len);

DragonFly's std_copyin/std_copyout (sys/platform/pc64/x86_64/support.s:228-328) validate only the user-side argument (≤ VM_MAX_USER_ADDRESS); the kernel-side pointer is used raw. Upstream FreeBSD's cuse.c uses proc_vm_rwmem() which walks the target process's vm map; the DragonFly port replaced it with this shim and lost every safety property:

• CUSE_IOCTL_WRITE_DATA with peer_ptr ≥ CUSE_BUF_MAX_PTR (0x20000) and outside the client's bounce-buffer window takes cuse_server_data_copy_locked → cuse_proc2proc_copy(curproc, local_ptr, client_proc, peer_ptr, len) → copyin(local_ptr /*validated user*/, peer_ptr /*RAW KERNEL DST*/, len) = arbitrary kernel write with server-controlled data and length (no length cap on this path).
• CUSE_IOCTL_READ_DATA analogously lands in copyout(peer_ptr /*RAW KERNEL SRC*/, local_ptr /*validated user*/, len) = arbitrary kernel read into the server's userspace.

Preconditions: an open /dev/cuse server fd (mode 0600 → root) plus one pending client command (any user opening a created /dev/<name> node and blocking in open/read/write/ioctl). CUSE_IOCTL_CREATE_DEV requires SYSCAP_NODRIVER — the intended deployment is exactly a caps-restricted daemon (webcamd/uhidd style), so this is a sandbox/caps-jail escape to full kernel compromise, not an unprivileged-local primitive.

Functional half of the bug: for a legitimate server passing the client's real user VA, the copy touches the SERVER's own address space at that VA — normally unmapped → EFAULT, silently corrupting the server otherwise. All cuse data transfers that miss the ≤4 KiB bounce-buffer fast path are broken (fixtest_baseline.log proves it: WRITE_DATA returned 14 (Bad address) and the client's buffer stays empty).

Reproduced (4/4 runs, incl. fresh vm.sh reset with-src boots)

• kernel READ of version at 0xffffffff81144960 returns the kernel version string (run.log)
• kernel WRITE of the same symbol sticks, readback CUSE-PWNED ... (run.log), self-restored afterwards
• full chain to uid=0 for an unprivileged process: sysctl kern.proc.pid.<child> → kp_paddr (struct proc) → proc+0x10 (p_ucred) → zero all uid/gid fields that equal 65534 → child prints getuid=0 geteuid=0, execs a shell → uid=0(root) gid=0(wheel), reads /etc/spwd.db

Fix validation

fix.diff replaces proc_rwmem_dfly with a procfs_rwmem()-style page-by-page walk (vm_fault_page + pmap_kenter_quick + uiomove) of the target process's map and rejects peer addresses ≥ VM_MAX_USER_ADDRESS. Rebuilt cuse.ko only (incremental kernel-module build, fix_build.log), installed, rebooted:

• fix_run.log / fix_run.2.log: kernel READ → EFAULT, no uid0, PoC RC=1
• fix_run_wprobe.log: kernel WRITE → EFAULT (rc=-1 errno=14)
• fix_run_fixtest.log: positive control — a legitimate >4 KiB server→client transfer now WORKS (cross-process fallback copy WORKS), which the unpatched kernel could not do (fixtest_baseline.log)

Files

• cuse_krw.c — main PoC (read/write/uid0 chain)
• wprobe.c — write-side one-shot probe
• fixtest.c — positive functional control of the fallback copy
• build.sh, run.sh — exact commands
• run.log, run.2.log, run.3.log — baseline reproductions
• fix_build.log, fix_run*.log, fixtest_baseline.log — fix validation
• env.txt — guest state

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.