DF-4753 — cxm(4) msp34xxx audio-decoder calls run unserialized against cxm_detach → UAF

File: sys/dev/video/cxm/cxm_msp34xxx.c (pass 2; root cause shared with cxm.c)

What

Every exported cxm_msp_* function dereferences sc / sc->iicbus / sc->dev with no lock anywhere in the driver (struct cxm_softc (cxm.h:216-264) has no lock member; there is no priv_check in cxm.c):

• cxm_msp_init cxm_msp_dpl_reset(sc->iicbus, ...) (cxm_msp34xxx.c:295),
• all of cxm_msp_dpl_read/write dispatch through sc->iicbus (cxm_msp34xxx.c:230/266 via callers at :298,:302,:338,:365,...),
• cxm_msp_wait_for_lock tsleeps 10 × hz/20 (~500 ms window) (cxm_msp34xxx.c:601-622) and then logs through sc->dev (cxm_msp34xxx.c:624).

The ioctl surface reaching these is unprivileged: /dev/cxmN is created mode 0444 (cxm.c:1885-1886) so any user can open(O_RDONLY), and DF devfs does not gate ioctl() on the open mode:

unprivileged ioctl(BT848_SAUDIO, AUDIO_TUNER)     cxm.c:2358
  -> cxm_pause_encoder / cxm_msp_select_source    cxm.c:2401-2404
  -> cxm_encoder_wait_for_lock                    cxm.c:~1510
  -> cxm_msp_autodetect_standard                  cxm.c:1574
  -> cxm_msp_wait_for_lock (sleeps ~0.5 s)        cxm_msp34xxx.c:588-626

While such an ioctl sleeps, privileged kldunload cxm (module ships as /boot/kernel/cxm.ko) runs cxm_detach (cxm.c:1944-2004), which dev_ops_remove_minor()s the cdev, detaches the I2C bus children (cxm.c:1993-1996) and, at module unload completion, the devclass frees the softc. The sleeping ioctl then wakes into freed memory: reads sc->iicbus (garbage/NULL → method dispatch on a dangling device_t), and device_printf(sc->dev, ...) (cxm_msp34xxx.c:624) dereferences a dangling sc->dev. Secondary defect in the same no-locking family: cxm_open's is_opened check-then-set is unlocked (cxm.c:2158-2161), so racing opens defeat the single-open serialization and interleave I2C transactions.

This is the cxm twin of bktr's DF-4419; the cxm.c pass-1/pass-2 audits (DF-1295, DF-3941) never covered the detach-vs-ioctl lifetime hole.

Impact

Low — triggering the freeing side requires privilege (kldunload / PCI hot-remove), exactly like DF-4419 (bktr, Low). Once triggered: reliable use-after-free deref (NULL/garbage device_t vtable dispatch, dangling sc->dev) → kernel panic; heap-reclaim exploitation is theoretically possible but not developed (hardware-gated).

Reproduce (hardware-gated)

cxm_uaf_race.c + run.sh: victim child hammers BT848_SAUDIO; root parent loops kldunload cxm; kldload cxm. Requires a Conexant iTVC15/16 card. On the audit guest: kldload cxm succeeds but no /dev/cxm* appears (no card) → trigger exits 3.

Fix

fix.diff (cxm.h + cxm.c): add struct lock cxm_lock, serialize open/close/ioctl, and drain it in cxm_detach before tearing the softc apart. Compile-validated as the full cxm.ko module with -Werror (fix_build.log).

DF-4753 VERDICT

Status: INCONCLUSIVE (runtime) — structural defect certain by source trace; runtime reproduction hardware-gated (no Conexant CX2388x PCI card in the QEMU guest); fix compile-validated (full cxm.ko, -Werror).

Impact: Low — UAF (panic ceiling) with a privileged trigger half, the cxm twin of DF-4419 (bktr, Low). Bucket: memcorrupt.

Why it is real (source trace)

1. No serialization anywhere. struct cxm_softc (cxm.h:216-264) has no lock; rg lockmgr|lockinit over cxm.c returns nothing. cxm_ioctl (cxm.c:2306) fetches sc and immediately dispatches.
2. Long sleep window with sc stack-referenced only. cxm_msp_wait_for_lock (cxm_msp34xxx.c:588-626) loops tsleep(&sc->iicbus, 0, "audio", hz/20) ×10 = ~0.5 s per call; reached from the unprivileged ioctl path BT848_SAUDIO → cxm_encoder_wait_for_lock (cxm.c:2410) → cxm_msp_autodetect_standard (cxm.c:1574).
3. Unprivileged surface. /dev/cxmN is make_dev(&cxm_ops, unit, 0, 0, 0444, "cxm%d", unit) (cxm.c:1885-1886); DF devfs does not check open mode for ioctls; no priv_check exists in cxm.c (rg: 0 hits). Pass-1 cxm_ir audit reached the same conclusion for REMOTE_GETKEY.
4. Freed mid-flight. cxm_detach (cxm.c:1944-2004) = dev_ops_remove_minor (cxm.c:1957) → DMA teardown → bus_generic_detach + device_delete_child of the I2C children (cxm.c:1993-1996) → resource release. destroy_dev/dev_ops_remove_minor only revector NEW calls to dead ops (kern_conf.c:334-343, kern_device.c:83); an ioctl already inside the old body keeps running. Module unload then frees the softc (devclass free after detach). The sleeper wakes and executes cxm_msp_is_locked → cxm_msp_dpl_read(sc->iicbus, …) (cxm_msp34xxx.c:560) and device_printf(sc->dev, …) (cxm_msp34xxx.c:624) on freed memory → NULL/garbage device_t method dispatch → panic.
5. Sibling defect in the same family (folded): cxm_open's if (sc->is_opened) return EBUSY; sc->is_opened = 1; (cxm.c:2158-2161) is an unlocked TOCTOU — racing opens defeat single-open and interleave iicbb transactions on the shared bus.

Guest verification (what could and could not be done)

• kldload cxm succeeds (module present: /boot/kernel/cxm.ko), kldstat -v shows the cxm driver registered — but no /dev/cxm0 appears (no Conexant iTVC15/16 PCI device in QEMU) → the victim ioctl cannot be instantiated; kldunload cxm clean. See run.log.
• PoC cxm_uaf_race.c written with verified constants (BT848_SAUDIO _IOW('x',46,int), AUDIO_TUNER 0x00 from ioctl_bt848.h:83,130); exits 3 with a clear hardware-gated message.
• Fix compile-validated: baseline cxm.ko and fix.diff-patched cxm.ko both built on the guest against pristine /usr/src with -Werror (build.log, fix_build.log, rc=0 both).
• Guest /usr/src restored and hash-verified afterwards (cxm.c 22808bde…, cxm.h 3c863567…).

Negative results for the other hunt items (this file)

• DF-1600 carrier-detect twin: ABSENT. cxm_msp34xxx.c has no carrier_detect loop (rg 'carrier' over sys/dev/video/cxm: 0 hits); the driver uses MSP34x5 AUTOMATIC Standard Select (init writes DEM 0x0020, cxm_msp34xxx.c:74-75) and polls the 2-byte STATUS/standard registers in cxm_msp_is_locked (:575-583) — no max1=-1 indexing pattern exists.
• msp_name overflow: SAFE (bktr DF-1850 does not carry over): cxm uses bounded ksnprintf(sc->msp_name /* [10] */, ...) (cxm_msp34xxx.c:306, cxm.h:249); format always emits ≥ 8 chars so msp_name[3]/[4] probes (:315-316, :332) stay in-bounds; worst-case 11-char output truncates.
• read/write helpers: received/sent set by the iic layer; -1 return vs sizeof() (size_t) comparison catches errors; no short-read use of uninitialized stack buffers (buffers only consumed when the return equals the expected size).
• No volume table walk exists in cxm (mute/unmute are fixed register writes); no division anywhere in the file.

Fix

fix.diff (cxm.h + cxm.c): struct lock cxm_lock in the softc, lockinit in attach, lock held across open/close and the whole ioctl body (thin cxm_ioctl wrapper around the renamed cxm_ioctl_locked), and a drain (LK_EXCLUSIVE acquire/release) in cxm_detach right after dev_ops_remove_minor, with lockuninit as the last step. Known residual (not introduced here): cxm_read still runs unlocked — that path is owned by DF-3941's read-ring rework.

Baseline vs patched

Not runtime-testable on this guest (no cxm hardware). fix_status =inconclusive: build verified (cxm.ko, -Werror), behavior hardware-gated.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.