DF-4929 VERDICT — tpm_crb/tpm20 detach-vs-transmit UAF

Status: REPRODUCED (kernel panic, use-after-free on driver teardown). Fixed by fix.diff (validated on a patched kernel).

Root cause (source trace)

• tpm20_write (sys/dev/crypto/tpm/tpm20.c:100-145) acquires sc->dev_lock EXCLUSIVE at :124 and holds it across the whole sc->transmit() call (:135) — which for CRB means tpmcrb_transmit, polling for up to TPM_TIMEOUT_LONG = 40 s (tpm_crb.c:377, tpm20.h:71).
• tpmcrb_detach (sys/dev/crypto/tpm/tpm_crb.c:230-243) calls tpm20_release without acquiring dev_lock and without draining: tpm20_release (tpm20.c:211-226) does kfree(sc->buf), lockuninit, cv_destroy, destroy_dev unconditionally.
• lockuninit's KKASSERT (sys/kern/kern_lock.c:1325-1334) requires only !(count & (LKC_EXREQ|LKC_UPREQ)) && ((count & LKC_SHARED) || (count & LKC_SMASK) == 0) — an exclusively-held lock has count==1, which passes: teardown proceeds under the holder. Proven at runtime ("lockuninit assert did NOT fire" with lockstatus=8=LK_EXCLUSIVE).
• destroy_dev -> devfs_destroy_dev (sys/vfs/devfs/devfs_core.c:758-765) only posts an async node-destruction message; it does not wait for open descriptors or executing cdev handlers, so kldunload tpm (the tpm driver is a KMOD, sys/dev/crypto/tpm/Makefile) completes while the transmit thread is still inside the driver.
• newbus then frees the softc (device_set_driver(dev, NULL) -> kfree(softc), sys/kern/subr_bus.c:1943-1954). The transmitting thread and the discard_buffer_callout armed by tpm20_write (tpm20.c:138-139) keep using the freed softc: sc->pending_data_length store (tpm_crb.c:402), callout_reset/owner_tid/LK_RELEASE (tpm20.c:138-143), and — the deterministic killer — tpm20_discard_buffer ~500 ms later: lockmgr on the freed lock and memset(sc->buf, 0, TPM_BUFSIZE) with sc->buf (and sc->dev for device_printf) read from freed memory (tpm20.c:147-166). If the chunk is reclaimed before the callout fires, this is a fully groomable wild kernel write.

Reproduction

uafsim.c #includes the STOCK /usr/src/sys/dev/crypto/tpm/tpm20.c (sha256 b3eea3fcaf1e... identical to the audited tree — see build.log), so tpm20_write, tpm20_release, tpm20_discard_buffer, the callout arming and the dev_lock protocol are the shipped code. Only the MMIO transport is stubbed (fake_transmit mimics tpmcrb_transmit's poll-loop timing and its pending_data_length epilogue). The hw.uafsim_detach=1 sysctl replays the kldunload tpm sequence: stock tpm20_release, softc kfree, heap spray.

• Run 1 (detach after writer finished, callout armed): stock tpm20_discard_buffer fired on the freed softc → Fatal trap 12 in device_print_prettyname (device_printf(sc->dev,...) reading freed memory), callout context (current process = Idle). Guest down.
• Run 2 (detach mid-transmit, lockstatus=8 held): lockuninit passed on the held lock; writer woke on the freed softc and completed silently (WRITER DONE rc=0 — silent UAF writes); ~500 ms later the callout panicked identically. Guest down. 2/2 deterministic panics.

Exploitability ceiling

Trigger requires root twice over: kldunload tpm (or any forced detach) and an open /dev/tpm0 (0600 root:wheel). It is therefore a privileged-actor kernel UAF / reliable local DoS, NOT an unpriv->root escalation. The primitive itself is strong: with heap grooming between the kfree and the 500 ms delayed callout, memset(groomed_ptr, 0, 0x1000) plus lockmgr-on-groomed-lock are attacker-shaped kernel writes; on this intentionally unhardened guest the only missing ingredient for uid=0 is an unprivileged trigger, which does not exist for this path.

Fix validation (mandatory: memory corruption reproduced)

fix.diff (tpm20.c/tpm20.h): tpm20_release now drains the discard callout before and after a critical section that acquires dev_lock EXCLUSIVE, sets sc->dying, destroys the cdev and frees the buffer; tpm20_read, tpm20_write and tpm20_discard_buffer bail on dying. Applied to the guest /usr/src, kernel rebuilt (nativekernel, 0 errors) and installed. Re-running the IDENTICAL reproducer on the patched kernel: same race fires (lockstatus=8 printed), the detach sysctl blocks until the writer completes, teardown is serialized, callout drained — no panic, guest up, rc=0 (run_fixed.log). Baseline 2/2 panic vs patched 1/1 clean.

Residual (documented, out of scope of the validated diff): threads blocked in cv_wait inside tpm20_write across an unload are woken by cv_broadcast and bail on dying; a belt-and-braces open-refcount (refuse module unload while /dev/tpm0 is open) would close the last window.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.