DF-4919 — cancel_work_sync()/flush_work() read per-work flags without the guarding lock: premature "idle" return while the work is about to execute → UAF-class contract violation

sys/dev/drm/linux_workqueue.c — process_all_work() dequeues a work and only afterwards marks it running, with the whole transition under worker_lock:

74:   work->on_queue = false;        /* dequeued            */
87:   work->running = true;          /* about to run func() */

queue_work() publishes the insert under the target worker's lock (:134-146), but _cancel_work() and flush_work() read on_queue / running without any lock:

331:  while (work->on_queue || work->running)   /* flush_work   */
349:  if (work->on_queue) { ... }               /* _cancel_work */
364:  if (work->running == false) break;        /* RETURN       */

A caller whose load pair straddles (a) the worker's dequeue→start transition or (b) a concurrent queue_work() insert publication observes on_queue==false && running==false and returns — while the work function is about to execute — directly violating the contract spelled out above cancel_work_sync() (lines 390-394): "callers may free associated data structures after this call." A caller that frees (kfree of the container, or return of the stack frame holding an INIT_WORK_ONSTACK work, e.g. drm_framebuffer.c:475-481 drm_mode_rmfb, an unprivileged DRM ioctl path) leaves process_all_work() about to call work->func(work) through freed / stack-reused memory: arbitrary-call use-after-free. In the race case cancel_work_sync() also returns FALSE ("work wasn't pending") for a work that was queued and executes — the demonstrable lie.

Linux resolves exactly these races with the WORK_STRUCT_PENDING atomic claim (queue vs cancel vs flush are coherent); the shim has no such protocol, and the flags are guarded by different (or no) locks.

Build (guest, root)

kldload drm                # workqueue shim lives in drm.ko
cd /tmp/df4919 && make

Run

kldload /tmp/df4919/df4919.ko
sysctl hw.df4919_test=1    # cancel_work_sync race; safe stop+report (~90s)
# crash proof (guest panics):
sysctl hw.df4919_test=2
sysctl hw.df4919_status    # counters

Expected

Unpatched (baseline): a *** POSTHUMOUS EXECUTION AFTER SYNC-CANCEL/FLUSH RETURN — CONFIRMED *** line (work function ran with the alive-flag the canceller cleared after cancel_work_sync() returned), or — test=2 — panic: DF-4919: work executed AFTER cancel_work_sync() returned with trace wk_func() <- wq_worker_thread() (panic.txt).

Patched (claim protocol + flags spinlock): no classifier-confirmed hit in multi-million-cancel runs; guest healthy through 90 s of hammering.

DF-4919 VERDICT — REPRODUCED (posthumous work execution after cancel_work_sync() returned; panic proof; UAF-class contract violation)

The defect (source-level)

• process_all_work() — linux_workqueue.c:74 sets on_queue=false (dequeue) and only :87 sets running=true, the whole transition under worker_lock; queue_work() publishes on_queue/worker under the target worker's lock (:134-146).
• _cancel_work() reads both flags unlocked (:349, :364) and flush_work() likewise (:331). A load pair straddling either mutation window yields (on_queue==false && running==false) → return while work->func() is about to execute.
• The API contract above cancel_work_sync() (:390-394) explicitly permits freeing the work after return → the caller frees, the worker calls a function pointer out of freed/stack-reused memory. (Linux makes these races coherent with the atomic WORK_STRUCT_PENDING claim; the shim has no equivalent and the flags are guarded by different or no locks.)

Reproduction on the audit guest (DragonFly 6.5-DEVELOPMENT, 6 CPUs)

Kernel module df4919.ko (drm.ko provides the shim): a feeder thread keeps exactly one work instance in flight (quiescent per instance: publish → wait for resolution → grace), two canceller threads hammer cancel_work_sync(). The work function samples the alive flag — which each canceller clears after its cancel_work_sync() returns — at entry. alive==0 at entry means a cancel returned before the function started for an instance that was published: posthumous execution.

Evidence chain (all logs in this pack):

1. Baseline hit (stock drm.ko): any_hit=1 — first posthumous execution after ~174k cancel ops (run.log, quiescent-feeder version), and the final harness produced 6+ posthumous entries in one 90 s run (run.log tail, HIT ring lines with the 5:0 = func-entry-with-alive=0 event adjacent to cancel false-returns).
2. Kernel-level crash proof (twice): sysctl hw.df4919_test=2 → panic: DF-4919: work executed AFTER cancel_work_sync()/flush_work() returned — process_all_work called func on work the caller was told is dead (linux_workqueue.c:74 vs :364) — trace wk_func() <- wq_worker_thread(), cpuid 1 (panic.txt). In a real caller this moment is the UAF detonation: work->func(work) on memory the caller was contractually allowed to free (heap kfree or dead stack frame).
3. Narrowness measurements (honesty): a strictly single-driver variant (queue fully completes, then one cancel — only the ~2 ns dequeue→start transition is exposed) logged zero hits in ~150k cycles: that specific window is narrower than the canceller's load-to-load gap on this CPU. The readily-hit window is the insert publication vs the unlocked reads (concurrent queue_work() vs cancel_work_sync() on the same work — a pattern Linux handles coherently via the PENDING bit and in-tree DRM drivers do use). Both windows are the same root cause and the same contract violation.

Fix validation (fix.diff: pending-claim protocol + flags spinlock)

fix.diff spans include/linux/workqueue.h (adds volatile u_int wq_claim to struct work_struct; INIT_WORK clears it) and linux_workqueue.c:

• queue_work() atomically claims the right to make the work pending before taking any lock (Linux WORK_STRUCT_PENDING equivalent);
• the worker's dequeue→start transition and post-run flag updates, and the insert publication, run under a work_flags_lock spinlock (lock order: worker_lock → work_flags_lock), and the claim is released at running=true / on removal / on the drop paths;
• _cancel_work()'s and flush_work()'s idle verdicts require both the claim (cmpset) and coherent flag reads — an idle verdict is no longer renderable while an insert or the transition is in flight.

Applied to the guest's /usr/src, drm.ko rebuilt, identical harness:

• baseline (stock): multiple posthumous executions per 90 s run; the panic variant crashes the guest in seconds-to-minutes of hammering.
• patched: no classifier-confirmed hit in 2.8M-3.5M cancel operations across repeated 90 s runs (run_fixed.log; the residual single real=1 per multi-million ops is at the harness's own measurement noise floor — pre-claim verdict stores skewing past the feeder's fenced snapshot; the same classifier also flags noise on stock). The guest stayed healthy through full-length hammering runs, and the shim's normal operation (runs/cancels/queues counters) kept functioning.

Exploitability note

The demonstrated primitive is the contract violation itself: work runs after the caller was told it is dead. The escalation to arbitrary call is caller-pattern-dependent (caller must free or leave-stack after the sync-cancel/flush — exactly what drm_framebuffer.c:475-481 does after flush_work() on an INIT_WORK_ONSTACK work reached from the unprivileged DRM_IOCTL_MODE_RMFB path). No end-to-end uid=0 chain was built for this shim bug in this run: the racing window at its widest is the insert-publication window, requiring a concurrent queuer; the sequential-only path (stack work + flush_work as in rmfb) rides the ~2 ns transition window, measured effectively un-hittable at ~150k samples. Impact therefore recorded as the demonstrated panic-class manifestation with a UAF/arbitrary-call ceiling.

Kernel references

• sys/dev/drm/linux_workqueue.c:74,87 (locked dequeue→start transition)
• sys/dev/drm/linux_workqueue.c:134-146 (insert publication under worker_lock)
• sys/dev/drm/linux_workqueue.c:331 (flush_work unlocked flag loop)
• sys/dev/drm/linux_workqueue.c:349,364 (_cancel_work unlocked reads/return)
• sys/dev/drm/linux_workqueue.c:390-394 (the free-after-cancel contract)
• sys/dev/drm/drm_framebuffer.c:475-481 (stack work + flush_work, unpriv ioctl)
• sys/dev/drm/i915/i915_irq.c:2952-2961,3180 (stack delayed_work cancel site)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.