DF-4542 — syscons CONS_SET mode change vs tty output: no common lock → reproducible kernel panic (+ UAF-write window)

Summary

sc_set_text_mode() (sys/dev/misc/syscons/scvidctl.c:54-184) tears down and reallocates the per-vty shadow screen buffer (scp->vtb, via sc_alloc_scr_buffer(), free+kmalloc with wait=TRUE, i.e. it can SLEEP mid-mutation) and the scrollback ring (scp->history, via lock-free sc_alloc_history_buffer()), and rewrites scp->xsize/ysize/ xpos/... while holding only lwkt's vga_token.

The tty output path (scstart() → sc_puts() → terminal emulator writing scp->vtb and pushing scroll lines into scp->history) holds only the syscons_mtx spinlock.

The two paths share no lock. vga_token is not held by the output path and is dropped by LWKT whenever the mode-change thread blocks inside the M_WAITOK allocation, so the output/render path can execute against a half-updated scp: freed vtb/history rings being written by the emulator (UAF write), torn xsize vs. buffer geometry (OOB write).

Under contention this corrupts kernel synchronization state and panics:

panic with 1 spinlocks held
panic: assertion "count & TOK_COUNTMASK" failed in _lwkt_reltokref
       at /usr/src/sys/kern/lwkt_token.c:458
cpuid = N
Trace: lwkt_relalltokens() ... lwkt_switch()

Reproduction (audit guest, DragonFly 6.5-DEVELOPMENT, X86_64_GENERIC)

scstress.c — N concurrent ioctl threads doing CONS_SET text-mode cycles (80x25 ↔ 80x50 ↔ 80x30 ↔ 80x60) on /dev/ttyv1..4, plus writer threads spamming write() (forcing sc_puts + history scroll).

Isolation matrix (60 s each):

3/3 panics in the CONS_SET+writer configurations, zero panics in any single-stressor round. Minimal pair = CONS_SET (sc_set_text_mode) concurrent with tty writes (scstart/sc_puts).

Threat model

Any process holding a writable fd on a /dev/ttyvN can issue CONS_SET — sc_vid_ioctl performs no privilege check; only device permissions gate it (root-only 0600 on the default ssh-accessible guest; a user logged in on a real console holds such an fd for their session). Two processes (or threads) suffice: one mode-cycling (e.g. what vidcontrol/X startup does), one printing. Result: reliable local kernel panic (DoS) with a genuine kernel-heap UAF-write window behind it (emulator glyphs written into freed M_SYSCONS slabs).

Fix

fix.diff — serialize the mode-change commit against the output path: export syscons_lock()/syscons_unlock(), do the sleeping buffer allocation first, swap pointers + update scp meta fields + reinit the emulator under the (reentrant) syscons_mtx spinlock, and free old buffers outside it. Validated: patched kernel survives the identical stress that panicked 3/3 (see VERDICT.md).

Files

• scstress.c / scprobe.c — sources
• build.sh / run.sh
• run.panic{1,2,3}_bootlog.txt — the three panics
• env.txt — guest environment
• fix.diff — validated fix (never applied to the read-only sys/ tree; applied only inside the guest's /usr/src copy for validation)

DF-4542 — VERDICT

Status: reproduced (impact: panic — reliable local kernel DoS from console-reachable ioctls; underlying class is a heap UAF/double-free window). Fix validated on the guest (v2 patch: panic gone across all previously-fatal stress configurations).

Reproduced

Stock DragonFly 6.5-DEVELOPMENT #0 Jul 2 2026 X86_64_GENERIC guest (QEMU/KVM, 6 vCPU, std VGA text console, no VESA/KMS):

• 3/3 panics in ≤60 s whenever CONS_SET text-mode cycling runs concurrently with write() traffic on the same /dev/ttyvN: panic with 1 spinlocks held panic: assertion "count & TOK_COUNTMASK" failed in _lwkt_reltokref at /usr/src/sys/kern/lwkt_token.c:458 cpuid = 2/5/5 (run.panic{1,2,3}_bootlog.txt)
• Isolation matrix proves the pair:
• ioctl churn alone (2.9M ioctls) — clean
• writers alone (1.3M writes) — clean
• CONS_SET + writers — panic (mode 10; also full-mix modes 3/7)
• fix v1 (serialize only the buffer swaps) changed the manifestation into the raw heap double-free: panic: BADFREE2 _kfree() <- sc_vtb_destroy() <- sc_alloc_scr_buffer() <- sc_set_text_mode() <- sc_vid_ioctl() (fixv1.BADFREE2_bootlog.txt) — direct confirmation that the mode-change path frees heap buffers that are still being managed concurrently.

Root cause (path:line)

• sc_set_text_mode() scvidctl.c:54-184 holds only vga_token (scvidctl.c:64) across the entire scp mutation + buffer reallocation.
• sc_alloc_scr_buffer() syscons.c:3560-3587 frees the old scp->vtb and kmallocs a new one with wait=TRUE → kmalloc(M_WAITOK): when the ioctl thread sleeps, LWKT drops vga_token (lwkt_relalltokens in lwkt_switch), so neither vga_token nor any other lock excludes:
• the tty output path scstart() → sc_puts() (syscons.c) which writes scp->vtb and pushes scroll lines into scp->history under syscons_mtx only (a spin lock, syscons_lock() syscons.c:244) — no common lock;
• a second concurrent CONS_SET (serialized by vga_token only while nobody sleeps).
• sc_alloc_history_buffer() schistory.c:72-173 is completely lock-free (read-NULL-out / install / free of scp->history), racing the same writers.
• Result: emulator writes into freed M_SYSCONS slabs (UAF write) and torn scp geometry (OOB write window); observed kernel-synchronization corruption → deterministic panic.

Exploitability

• Reach: any process with a writable fd on /dev/ttyvN — sc_vid_ioctl does no privilege check (syscons.c:983-986 forwards directly; the only gate is device permission — 0600 root on the ssh-only audit guest, but a real console-login session holds such an fd; vidcontrol/X startup issue CONS_SET routinely while getty/init write).
• The verified product is the reliable panic (DoS). The UAF-write primitive (attacker-controlled glyph/attribute u_shorts written by the emulator into a freed slab, race-window dependent, M_SYSCONS grooming) was NOT weaponized to uid=0 in this run — the win requires deterministic race timing; recorded as the escalation route.

Fix validation

• v1 (swap under syscons_mtx only): BADFREE2 remained (CONS_SET-vs-CONS_SET interleave via token-drop-at-sleep) — valuable negative result.
• v2 (fix.diff, in this pack): allocate the new vtb first with M_NOWAIT; commit meta fields + vtb swap + sc_init_emulator() + cut-buffer under the reentrant syscons_mtx spinlock; free old buffers outside the spinlock; history detach/install/fail-restore under syscons_mtx in sc_alloc_history_buffer(); sc_alloc_scr_buffer() hardened the same way + refuses to install an invalid buffer.
• Patched kernel (#1 Mon Sep 21 10:17:20): three consecutive 60 s rounds of the exact fatal configurations (mode 10 ×2, mode 7 ×1; ~1M CONS_SET, ~3M writes, VT cycling) — all clean, guest alive (run.log).

fix_status: fixed (baseline reproduced 3/3; patched reproduced 0/3).

Residual (noted for upstream)

The async renderer's draw phase runs without syscons_mtx (scrn_update drops it, syscons.c) and without vga_token for most of its vtb reads; a theoretical render-vs-mode-change read race remains (active console only). Upstream may want vga_token (or a dedicated lock) around the vgarndr text draw loops as follow-up hardening.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.