DF-5099 — joyopen/joyclose exclusive-access protocol is an unlocked TOCTOU

What

joyopen() implements device exclusivity as check-then-set on the shared joy->timeout[i] flag with no serialization at all (sys/dev/misc/joy/joy.c:159-162):

if (joy->timeout[i])
    return EBUSY;
joy->x_off[i] = joy->y_off[i] = 0;
joy->timeout[i] = JOY_TIMEOUT;

joyclose() clears the same flag (joy.c:173). The file contains no lock, token, or atomic — the entire open/close/read/ioctl state machine (timeout[2], x_off[2], y_off[2]) is unsynchronized.

Defect mechanics

• Two CPUs racing open("/dev/joy0") can both read timeout[0] == 0, both skip EBUSY, and both store JOY_TIMEOUT — the exclusive-open guarantee is bypassed.
• A close() by one holder zeroes the flag while another holder still has the fd open, permanently dropping the claim for the remaining holder.
• joyioctl() mutates the same ints concurrently with an in-flight joyread() (harmless on its own — plain int fields, no tearing on the supported arches, and the read loop snapshots timeout once at joy.c:195).

Security impact

None beyond the broken exclusivity semantics: /dev/joy* is created 0600 root (make_dev(..., 0, 0, 0600, ...) at joy.c:133), so only root reaches any of this, and the raced state is plain ints in a devclass-allocated softc that is never freed (no detach path) — there is no lifetime or memory-safety consequence. Filed as Info hardening / correctness.

Build / run (as executed on the audit guest)

cc -O2 -Wall -o joy_open_race joy_open_race.c     # -> BUILD_OK, no warnings
./joy_open_race

Expected on hardware with /dev/joy0: exit 0 with iterations=2000 EBUSY-bypassing iterations=N stray opens=M, N>0. Observed on this guest: exit 2, open /dev/joy0: No such file or directory (errno=2) — joy(4) never attaches (no ISA gameport; kldload joy alone creates no node), so the race is not runtime-exercisable here. See run.log, env.txt.

Fix

One-word claim via atomic_cmpset_int() (see fix.diff).

DF-5099 VERDICT

Status: inconclusive (not runtime-exercisable on this guest) — defect proven from source; Info hardening finding, PoC skipped per contract.

Reproduced?

No — and provably impossible on this guest. The joy(4) driver is module-only (/boot/kernel/joy.ko); it attaches only to ISA/PnP gameport hardware (joy_probe/joy_attach, sys/dev/misc/joy/joy.c:103-135). The audit guest has no such hardware: /dev/joy* is absent, and even after kldload joy no device node appears (see run.log, env.txt). Both trigger binaries build cleanly on the guest (cc 8.3, -Wall, zero diagnostics) and exit 2 at open() with ENOENT.

Why the defect is real anyway (source proof)

• joyopen() — joy.c:159-162: if (joy->timeout[i]) return EBUSY; followed by joy->timeout[i] = JOY_TIMEOUT; — an unsynchronized check-then-set on shared state. No lock, token, or atomic anywhere in the file (includes at joy.c:31-45).
• joyclose() — joy.c:173: unconditional joy->timeout[i] = 0; — drops the exclusive claim while other holders may still have the device open (post-TOCTOU double-open, or dup'd fds closed out of order).
• Consequence: two racing open()s both succeed (EBUSY bypassed); exclusivity is advisory and racy. That is the entire impact — the raced fields are plain ints in a never-freed devclass softc (no detach method exists), so there is no memory-safety or lifetime consequence.

Impact ceiling

Bounded by the device node's permissions: make_dev(&joy_ops, unit, 0, 0, 0600, "joy%d", unit) at joy.c:133 creates the node root-only, so only root reaches this code at all. Info severity is the correct ceiling.

Why no fix validation

The fix (one-word atomic claim) is trivially correct by inspection but cannot be behaviorally validated on a guest whose kernel never instantiates the device. fix.diff is included untested-by-build; the guest was left clean (kldunload joy, exit=0).

Kernel references

• sys/dev/misc/joy/joy.c:159-162 (TOCTOU check-then-set in joyopen)
• sys/dev/misc/joy/joy.c:173 (joyclose clears claim unconditionally)
• sys/dev/misc/joy/joy.c:133 (root-only 0600 node — impact bound)
• sys/dev/misc/joy/joy.c:31-45 (no synchronization primitives included)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.