DF-4311 — vga_switcheroo unsafe module teardown (use-after-unload)

What: sys/dev/video/vga/vga_switcheroo.c MOD_UNLOAD/MOD_SHUTDOWN handler (free case at vga_switcheroo.c:1022-1027) tears down and frees the module's global state and lets the module unload even while other loaded kernel modules (drm.ko, i915.ko, amdgpu.ko) hold direct relocations to its exported symbols — and, on real hybrid-GPU systems, while DRM clients are registered in vgasr_priv->clients.

Impact: kldunload(8) of vga_switcheroo.ko followed by any vga_switcheroo_*() call from the DRM stack = call into freed module text + operation on freed heap state -> kernel panic (demonstrated) / heap UAF.

Privilege: kldunload requires root (and securelevel must allow it). This is a privileged-user UAF / robustness defect, NOT an unpriv escalation.

Files: uaftrig.c PoC module: stands in for drm.ko's live call-ins (drm_edid.c:1770 drm_get_edid_switcheroo -> vga_switcheroo_lock_ddc/unlock_ddc; i915_drv.c:742). Writing /dev/uaftrig performs exactly that call pair. Makefile builds uaftrig.ko (needs SYSDIR=/usr/src/sys) run.sh full run recipe (phases actually executed via vm.sh run_root) run.log baseline (unpatched) session: parser exercise + panic panic.txt serial-console panic (Fatal trap 12, IP in unloaded text) panic-full.log full console capture fix.log post-fix validation run (same guest, patched modules) fix.diff git-apply-able fix (passes git apply --check on sys/) env.txt guest environment

Build (in guest, as root): cd /root/uaftrig && make SYSDIR=/usr/src/sys

Run (in guest, as root): kldload vga_switcheroo kldload ./uaftrig.ko echo trigger > /dev/uaftrig # baseline: -19/-19 kldunload vga_switcheroo # SUCCEEDS (no dependency guard) echo trigger-after-unload > /dev/uaftrig # ==> kernel panic

Expected (unpatched): Fatal trap 12, instruction fetch fault at the unloaded module's text address; guest down with db> prompt. Expected (patched + MODULE_DEPEND declared in the dependent module): kldunload reports success but only drops a reference (module stays resident); trigger returns -19/-19; no panic.

VERDICT — DF-4311 vga_switcheroo unsafe module teardown UAF

STATUS: reproduced (kernel panic, root-triggered use-after-unload) IMPACT: panic — privileged local (kldunload requires root). Not an unprivileged escalation; classified Low severity for that reason, but the memory-corruption class is real: the crash is an instruction fetch at freed/unmapped module text, and on a system where the freed module VA range got reused, this is an arbitrary-code-execution primitive at a time of the admin's choosing; the vgasr_priv heap free additionally leaves lockmgr()-on-freed-memory writes for any later caller if the module text happened to remain mapped.

ROOT CAUSE (two independent halves, both required for the bug):

1. vga_switcheroo.c:1022-1027 — the module event handler runs destroy_dev(); kfree(vga_switcheroo_buf); kfree(vgasr_priv); for BOTH MOD_UNLOAD and MOD_SHUTDOWN (shared case labels), with:

   • no check that vgasr_priv->registered_clients == 0 or that vgasr_priv->handler == NULL,
   • no veto (always returns 0, so the unload always proceeds),
   • globals not NULLed, mux_hw_lk never lockuninit()ed.

2. No module declares a dependency on vga_switcheroo, although three modules in this tree hold direct relocations to its symbols:

   • drm.ko: drm_edid.c:1770-1772 vga_switcheroo_lock_ddc()/_unlock_ddc()
   • i915.ko: i915_drv.c:741-742 vga_switcheroo_handler_flags() / vga_switcheroo_force_migd() (live, #ifdef DragonFly)
   • amdgpu.ko: amdgpu_kms.c:950 vga_switcheroo_process_delayed_switch() sys/kern/kern_linker.c linker_file_lookup_symbol() (kern_linker.c:605-660) resolves such cross-file symbols with a GLOBAL search across all loaded files and records nothing; linker_file_add_dependancy() (kern_linker.c:575) is only invoked for DECLARED MODULE_DEPEND metadata (linker_load_dependencies, kern_linker.c:1583+). Consequently kldunload vga_switcheroo is not blocked while the DRM stack is loaded — verified live: the unload succeeded while the dependent module was resident, then the dependent's call faulted.

REPRODUCTION (DragonFly 6.5-DEVELOPMENT X86_64_GENERIC guest, QEMU): * uaftrig.ko is a stand-in for drm.ko: it references vga_switcheroo_lock_ddc()/unlock_ddc() exactly like drm_get_edid_switcheroo() does, and /dev/uaftrig invokes them. * kldload vga_switcheroo; kldload uaftrig.ko; baseline trigger: lock_ddc = -19 (-ENODEV, no handler), unlock_ddc = -19. * kldunload vga_switcheroo -> "vga_switcheroo device unloaded", rc=0 (module freed and unmapped while uaftrig still resident). * trigger -> Fatal trap 12: page fault in kernel mode, fault VA = 0xffffffff82601040 = instruction pointer, i.e. the CPU jumped into the unloaded module's text (module was mapped at 0xffffffff82600000 + 0x2000). Guest down at db>. * Secondary empirical results captured in run.log: the /dev write parser is bounded (255B/1024B/appends safe), all commands inert (module can never become active in this tree: every registration call site is compiled out), and unprivileged access is denied (0600).

FIX VALIDATION (see fix.log): * fix.diff applied to guest /usr/src; vga_switcheroo.ko rebuilt with the MOD_UNLOAD EBUSY guard + separate MOD_SHUTDOWN case; uaftrig.ko rebuilt with MODULE_DEPEND(uaftrig, vga_switcheroo, 1, 1, 1) modeling the drm/i915/amdgpu dependency declarations in fix.diff. * Same sequence: baseline -19/-19; kldunload vga_switcheroo now only DROPS A REFERENCE (kldstat shows the module still resident); the post-unload trigger returns -19/-19 with the guest alive — the exact operation that panicked the unpatched kernel. * After kldunload uaftrig, the linker chained the real vga_switcheroo unload automatically ("vga_switcheroo device unloaded", module gone). * Baseline reproduced pre-fix; patched behavior correct post-fix: fix_status = fixed.

PRIVILEGE / THREAT honesty: * Triggering requires root (kldunload). On securelevel>0 systems kldunload is refused entirely. So: Low severity, privileged-user UAF + shutdown-path state free. Filed because the teardown contract is wrong (a module must not free state its live callers depend on, and must not unload while exported-symbol callers hold relocations), and because the same handler frees live state at MOD_SHUTDOWN, which fires on every reboot with hybrid-GPU drivers mid-shutdown. * No unprivileged route exists to the write parser (0600 root:wheel, verified) — the pass-2 hunt of the parser itself was negative.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.