DF-4297 — kbd.c genkbd_softc lifetime bug on kbd_detach (stuck reader + write-after-free + panic)

What

sys/dev/misc/kbd/kbd.c kbd_detach() (lines 581-607) frees the cdev's si_drv1 (genkbd_softc, ~536 bytes, M_DEVBUF) while the /dev/kbdN file descriptor that owns it may still be open:

• no KBD_IS_BUSY() check,
• no wakeup() of readers blocked in genkbdread() (tsleep "kbdrea", kbd.c:750),
• no purge/invalidations for the kqueue knote list embedded in the sc (sc->gkb_rkq.ki_note, kbd.c:70),
• no release of the client callback registered by kbd_allocate() (kb_callback.kc_arg == sc, kbd.c:402-403).

Consequences (all demonstrated):

1. Blocked reader never woken — sleeps on a freed pointer forever until signalled.
2. Write-after-free — on signal, the EINTR path at kbd.c:756-759 executes sc->gkb_flags &= ~KB_ASLEEP on the freed (and, in our run, already re-allocated) chunk. Demonstrated byte-exact: groom pattern 0x55555555 became 0x55555554 at the freed address.
3. Kernel panic (UAF read) — when the keyboard is later unregistered (holder closes / driver terminates, exactly the ukbd unplug sequence: ukbd_detach → kbd_detach, ukbd.c:1408, then term → kbd_unregister), kbd_unregister delivers KBDIO_UNLOADING to genkbd_event whose registered arg is the freed sc; genkbd_event runs KNOTE(&sc->gkb_rkq.ki_note, 0) (kbd.c:905) walking a knote list inside freed memory → Fatal trap 9: general protection fault at knote+0x2c.

Threat model

Reaching genkbdread requires opening /dev/kbdN (0600 root:wheel, plus caps_priv_check_self(SYSCAP_RESTRICTEDROOT) in genkbdopen, kbd.c:672), and kbd_detach requires driver detach — module unload, or a physical USB keyboard unplug (ukbd_detach calls kbd_detach unconditionally while the keyboard stays registered for replug). So the trigger is privileged or physical-console; impact is kernel memory corruption / panic ⇒ Low severity, memory-corruption class.

Build (in guest, as root)

cd /root/kbduaf
cc -O -o kbd_uaf kbd_uaf.c
cc -O -o kbdrel kbdrel.c
cc -O -o kbdprobe kbdprobe.c
# module needs kbdreg.h next to the source (uses -I.)
cp /usr/src/sys/dev/misc/kbd/kbdreg.h .
printf 'KMOD=kbdkill\nSRCS=kbdkill.c\n\n.include <bsd.kmod.mk>\n' > Makefile
make
kldload vkbd            # mint fresh keyboards
kldload ./kbdkill.ko    # detach/groom/check helper module

kbdkill.ko does exactly what a driver detach does (kbd_detach(kbd)), plus detection sysctls: hw.kbdkill.index, .run (kbd_detach + immediate re-alloc of the freed chunk), .snap (gkb_flags at the freed address, pre-signal), .check2 (ggb_flags at the freed address, post-signal).

Run (in guest, as root)

sh /root/kbduaf/run.sh

The script: 1. pre-cleans stale vkbd children from kbdmux (KBRELKBD via /dev/ttyv0), 2. mints a fresh vkbd keyboard (hold /dev/vkbdctl open) → new /dev/kbdN, releases it from kbdmux, 3. runs kbd_uaf < /dev/kbdN which blocks in read(2) (kbdrea), 4. sysctl hw.kbdkill.run=1 → kbd_detach() frees the sc and immediately re-allocates the chunk filled with 0x55, 5. sysctl hw.kbdkill.snap=1 → freed sc gkb_flags == 0x55555555, 6. kill -USR1 the reader → its EINTR path clears bit0 of the freed/re-owned object → hw.kbdkill.check2=1 prints 0x55555554, 7. closes the vkbd holder → kbd_unregister → KBDIO_UNLOADING → KNOTE on the freed sc → kernel panic (serial console: Fatal trap 9 ... knote+0x2c).

Expected output

See run.log / panic.txt (serial console capture). Key lines:

kbdkill: run: before kbd_detach: kbd2 (vkbd0) si_drv1=0xfffff8008bb98180 gkb_flags=0x00000001
kbdkill: run: kbd_detach done - genkbd_softc freed at 0xfffff8008bb98180 ...
kbdkill: run: ... groomed 256 x 536 chunks (first @ 0xfffff8008bb98180)   <- same address
kbdkill: snap:  freed sc gkb_flags = 0x55555555 (pre-signal)
kbdkill: check2: freed sc gkb_flags now 0x55555554  <- WRITE-AFTER-FREE
Fatal trap 9: general protection fault while in kernel mode
Stopped at      knote+0x2c:     movq    0x30(%r15),%rbx

With fix.diff applied (patched kernel), the same script shows: the reader waking at detach (read returned -1 errno=6 No such device or address), the freed chunk staying 0x55555555, and no panic at holder close.

Fix

fix.diff — release the busy callback, KNOTE, wakeup(), then free; readers re-fetch dev->si_drv1 after every wakeup and bail ENXIO. Validated by rebuild + re-run (see VERDICT.md).

DF-4297 VERDICT — genkbd_softc lifetime bug in kbd_detach (sys/dev/misc/kbd/kbd.c)

Bottom line

REPRODUCED on the stock guest (kernel 6.5-DEVELOPMENT #0 Thu Jul 2 2026, snapshot clean-source): the bug gives (1) a permanently-blocked reader after driver detach, (2) a byte-exact write-after-free into a re-allocated heap object, and (3) a fatal kernel trap (panic) through the stale kb_callback.kc_arg → genkbd_event → KNOTE path. The full chain is triggered by nothing more than the sequence a real driver detach performs (ukbd_detach → kbd_detach, ukbd.c:1408), exercised by a root-loaded helper module that makes exactly that call, plus an ordinary open/read/close of /dev/kbdN and a vkbd console keyboard.

Reproduction narrative (baseline, unpatched)

Serial-console evidence in run.log / panic.txt:

1. kbd_uaf opens the freshly-minted /dev/kbd2 and blocks in read(2) — ps shows STAT S2 WCHAN kbdrea (genkbdread tsleep, kbd.c:750). At this point gkb_flags == 0x00000001 (KB_ASLEEP set by the sleeping reader).
2. hw.kbdkill.run=1 → kbd_detach(kbd) (the identical call ukbd_detach makes): si_drv1=0xfffff8008bb98180 freed, cdev minor removed — the reader is still asleep on the freed address (ps again: still kbdrea). The helper immediately re-allocates the 536-byte chunk and fills it with 0x55; the first groom chunk lands at the same address (first @ 0xfffff8008bb98180).
3. hw.kbdkill.snap=1: freed sc gkb_flags == 0x55555555.
4. kill -USR1 the reader: userland sees read(2) returned -1 errno=4 (EINTR) — proof it executed the kbd.c:756-759 error path. hw.kbdkill.check2=1: freed sc gkb_flags == 0x55555554 — bit 0 (KB_ASLEEP) cleared inside a live, re-owned kernel object at the freed address: write-after-free, exactly the sc->gkb_flags &= ~KB_ASLEEP statement at kbd.c:757 operating on freed memory.
5. Holder close → vkbd termination → kbd_unregister → KBDIO_UNLOADING delivered to genkbd_event(kbd, event, arg=sc) with the stale arg registered by kbd_allocate (kbd.c:402-403) → KNOTE(&sc->gkb_rkq.ki_note, 0) (kbd.c:905) walks a knote list embedded in the freed-and-rewritten chunk → Fatal trap 9: general protection fault, Stopped at knote+0x2c: movq 0x30(%r15),%rbx (r15 = 0x5555555555555555-derived garbage kn pointer). Guest dies at db>.

Root cause line map:

• kbd.c:597-603 — kbd_detach frees dev->si_drv1 with no KBD_IS_BUSY check, no wakeup, no knote purge, no callback release.
• kbd.c:744-761 — genkbdread sleeps on sc and only revalidates kbd (still valid: kbd_detach doesn't unregister), never si_drv1.
• kbd.c:756-759 — EINTR path performs the stale write.
• kbd.c:267-278 (kbd_unregister) → kb_callback.kc_func(KBDIO_UNLOADING) with kc_arg = freed sc → kbd.c:898-907 (genkbd_event) → KNOTE UAF read → panic.

Why the guest-panic is honest

The helper module only performs kbd_detach() — a public function every keyboard driver calls on detach — under the same conditions (cdev open, keyboard registered) a USB keyboard unplug produces. The groom/check sysctls are read/write probes on the freed chunk; the panic trigger (step 5) is the kernel's own kbd_unregister → genkbd_event path with no module involvement.

Impact classification

panic (kernel memory corruption, privileged/physical trigger). Not an unprivileged escalation: opening /dev/kbdN requires SYSCAP_RESTRICTEDROOT (kbd.c:672) and the detach requires driver detach (module unload = root, or physically unplugging a USB keyboard on a console with /dev/kbdN open).

Fix validation

fix.diff (this pack): kbd_detach releases the busy callback first (kbd_release), KNOTEs and wakeup()s the sleepers, then frees; genkbdread re-fetches dev->si_drv1 after every wakeup and returns ENXIO once it is NULL. Applied inside the guest's /usr/src, kernel rebuilt (make nativekernel KERNCONF=X86_64_GENERIC, kernel #1 Sat Sep 19 06:32:43), rebooted, identical PoC re-run (run.fix.log):

Fix status: fixed. Guest reset to the clean-source snapshot afterwards.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.