DF-4280 — ccd(4) CCDIOCCLR busy-guard can never be satisfied (unit permanently stuck)

Build

cc -O -o /tmp/df4280 /root/df4280/trigger.c     # on the guest, as root

Run (guest, root; ccd module + a CCD-labelled component required)

kldload ccd
vnconfig -c -s labels vn0 /root/comp0.img       # 8MB file-backed vnode disk
disklabel32 -R -r vn0 labelfile                  # with partition 'd: fstype ccd'
/tmp/df4280 /dev/ccd0 /dev/vn0s0d                # SET then same-fd CLR
ccdconfig -u ccd0                                # stock tool — also EBUSY
kldunload ccd                                    # "In use, cannot detach"

Expected (vulnerable kernel)

[+] CCDIOCSET ok size=16352
[-] CCDIOCCLR(same fd, no other users): Device busy
[-] BUG: unit can never be unconfigured this boot
ccdconfig: ioctl (CCDIOCCLR): /dev/ccd0: Device busy
ccd0: In use, cannot detach

Expected (patched kernel — fix.diff hunk 2: disk_getopencount guard)

[+] CCDIOCSET ok size=16352
[+] CCDIOCCLR ok

Root cause

• ccdattach stores cs->sc_dev = disk_create(...) — the RAW device (_disk_create_named returns dp->d_rawdev, subr_disk.c:763).
• make_only_dev() ends with reference_dev(devfs_dev) (kern_conf.c:294) — a permanent creator reference (destroy_only_dev releases TWICE, kern_conf.c:316-320, confirming the +1 convention).
• Therefore dev_drefs(cs->sc_dev) >= 2 at all times; the guard dev_drefs(cs->sc_dev) > 1 (ccd.c:1434) is unconditionally true.

Impact

Once configured, a ccd unit is stuck for the boot: components are held exclusively (cannot be reused/relabelled via other ccds), sc_cinfo / sc_itable stay allocated, CCDF_INITED blocks reconfiguration, and the ccd module can never be unloaded. Triggering requires write access to /dev/ccdN (root, or the operator group — nodes are 0640 root:operator).

DF-4280 VERDICT

Status: REPRODUCED (functional lockout / local DoS). Fixed by fix.diff hunk 2 and re-verified.

What was observed (baseline, vulnerable kernel — run.log)

1. Configure a unit via raw ioctl (no I/O at all), close the fd, then CCDIOCCLR through a fresh descriptor: CCDIOCCLR: Device busy.
2. CCDIOCCLR through the SAME still-open descriptor with zero other users: CCDIOCCLR(samefd): Device busy.
3. Stock ccdconfig -u ccd0: Device busy with fstat showing no holder.
4. kldunload ccd: ccd0: In use, cannot detach — forever.

Once any unit is configured it can never be unconfigured during the boot: CCDF_INITED stays set, every component vnode stays exclusively held (ccd.c:1526 v_opencount > 1 blocks reuse), sc_cinfo/sc_itable/ ii_index stay allocated, the module cannot unload.

Root cause (path:line)

• sys/kern/subr_disk.c:763 — _disk_create_named returns dp->d_rawdev; ccdattach stores it in cs->sc_dev.
• sys/kern/kern_conf.c:294 — make_only_dev() ends with reference_dev(devfs_dev): a PERMANENT creator reference (destroy_only_dev releases twice, kern_conf.c:316-320).
• Therefore dev_drefs(cs->sc_dev) >= 2 always, and the guard sys/dev/disk/ccd/ccd.c:1434 if (dev_drefs(cs->sc_dev) > 1) is unconditionally true — CCDIOCCLR can never pass it.

Fix

fix.diff hunk 2 replaces the guard with disk_getopencount(&cs->sc_disk) > 1 — d_opencount counts real opens of every node (whole/slice/partition) of the disk (subr_disk.c:1121/ 1150), which is exactly the semantic the guard wanted; in-flight raw I/O remains covered because the caller's descriptor stays open for the duration of physread/physwrite.

Fix validation (patched ccd.ko, same guest, fix_patched.log)

[+] CCDIOCSET ok size=16352
[+] CCDIOCCLR ok            <- was EBUSY
ccdconfig -u ccd0 -> ok     <- was EBUSY
kldunload ccd -> ok         <- was "In use, cannot detach"

No regression: configuration and I/O still work (DF-4279 control).

Impact

Not memory corruption. Local denial of service against the ccd subsystem (units wedge until reboot, module unload denied) by any user able to open /dev/ccdN for write (root or operator; the nodes are 0640 root:operator). Normal operational pain: ccd reconfiguration requires a reboot on affected kernels.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.