DF-5162 — bktr_mem stored-address registry goes stale across METEORSETGEO grow → write-after-free on driver reload

PoC verdict: not_reproduced on audit guest (no Bt848 hardware) — defect certain at source level.

Reproduce (on hardware)

cc -O2 -Wall -o grow_stale grow_stale.c     # build.sh
./grow_stale                                # unprivileged: METEORSETGEO grow
sudo sh reload_stale.sh                     # root: kldunload bktr; kldload bktr

Expected (on hardware)

• grow_stale prints that the grow ioctl was accepted — the bktr_mem registry for unit 0 now holds a kmem_free()d KVA in BKTR_MEM_BUF.
• After reload, common_bktr_attach() reinstalls that pointer and executes bzero(bigbuf, 3.5 MB) on freed KVA (bktr_core.c:429-432); any capture then DMAs into it. Watch dmesg for the re-attach buffer line (buffer size ... addr 0x... — the address equals the old freed one, not a fresh contigmalloc), then start streaming and observe corruption of whatever kernel objects were reallocated into the range (typically panic or silent data corruption).

What was run here

Guest DragonFly 6.5-DEVELOPMENT X86_64_GENERIC: build OK; run blocked at open(/dev/bktr0): ENOENT — no Brooktree PCI device in QEMU (see env.txt). See VERDICT.md for the full source-level proof with path:line citations and the fix (fix.diff).

DF-5162 — bktr_mem registry never invalidated when METEORSETGEO grow frees the frame buffer → freed KVA reinstalled and bzero()ed/DMA-written after driver reload

Verdict (short)

Not reproduced on the audit guest — the guest has no Bt848/Bt878 capture card (NO_BT8XX_PCI_DEVICE, no /dev/bktr*), so the trigger cannot run. The defect itself is proven at source level (certain): the grow path frees the attach-time frame buffer without updating the bktr_mem registry, and the registry has no invalidation mechanism at all. Every line of the chain is cited below; on real hardware the reload deterministically writes ~3.5 MB of kernel KVA that was returned to the kernel map by kmem_free().

File under audit

sys/dev/video/bktr/bktr_mem.c — the module whose entire purpose is to keep DMA buffer addresses valid across bktr.ko unload/reload. The lifetime defect lives in its (missing) invalidation contract and in its only consumer, bktr_core.c, violating it.

The chain, line by line

1. Attach stores all five buffers — common_bktr_attach(), sys/dev/video/bktr/bktr_core.c:415-419 (under #if defined(KLD_MODULE)): bktr_store_address(unit, BKTR_MEM_BUF, buf) etc. buf here is the contigmalloc'd BROOKTREE_ALLOC (217*4 pages = 868 pages ≈ 3.5 MB) buffer from bktr_core.c:404.

2. Registry API can only set, never clear — sys/dev/video/bktr/bktr_mem.c:103-138: bktr_store_address() sets addresses_stored = 1 (lines 115/119/123/127/131); no function in the file ever clears it or invalidates a stored pointer. (bktr_has_stored_addresses() bktr_mem.c:89-98, bktr_retrieve_address() bktr_mem.c:142-167 return the raw stored values.)

3. Unprivileged grow frees the stored buffer — METEORSETGEO handler, sys/dev/video/bktr/bktr_core.c:1655-1675: c buf = get_bktr_mem(unit, temp*PAGE_SIZE); /* 1667 */ if (buf != 0) { kmem_free(kernel_map, bktr->bigbuf, /* 1669 — OLD buffer freed */ (bktr->alloc_pages * PAGE_SIZE)); bktr->bigbuf = buf; /* 1672 */ bktr->alloc_pages = temp; /* 1673 */ No bktr_store_address(unit, BKTR_MEM_BUF, buf) follows. The registry entry for BKTR_MEM_BUF now holds freed KVA with addresses_stored == 1. Device node is make_dev(&bktr_ops, unit, 0, 0, 0444, "bktr%d", unit) (sys/dev/video/bktr/bktr_os.c:325) — world-readable; ioctls are permitted on an O_RDONLY fd, so the grow is unprivileged (consistent with pass-1 findings DF-3789/DF-4671 which treat METEORSETGEO as unprivileged).

4. Detach relies on the registry — sys/dev/video/bktr/bktr_os.c:362-364: "We do not free memory for RISC programs, grab buffer, vbi buffers. The memory is retained by the bktr_mem module so we can unload and then reload the main bktr driver module." The invariant this comment depends on was broken in step 3.

5. Reload reinstalls the freed pointer — common_bktr_attach() again, sys/dev/video/bktr/bktr_core.c:382-390: bktr_has_stored_addresses(unit) == 1 → retrieves all five addresses, need_to_allocate_memory = 0 → buf = the freed KVA.

6. Immediate deterministic write-after-free — sys/dev/video/bktr/bktr_core.c:429-432: c if ( buf != 0 ) { bktr->bigbuf = buf; /* freed pointer */ bktr->alloc_pages = BROOKTREE_ALLOC_PAGES; bzero((caddr_t) bktr->bigbuf, BROOKTREE_ALLOC); /* ≈3.5 MB zeroing of possibly-reallocated kernel KVA */ Subsequently, read(), mmap() (bktr_os.c:669-690) and the RISC DMA program builders target the same freed range as soon as capture starts: the DMA writes attacker-shaped video data into whatever now occupies that KVA.

Threat model

• Step 3 (plant the stale entry): unprivileged local user with access to /dev/bktr0 (0444).
• Steps 4-6 (harvest): requires root to kldunload bktr && kldload bktr — a mundane admin/driver-recycling operation, not an unusual privilege. There is no unprivileged-only path to the reload (attach only runs at module load / bus probe).
• Requires a Bt848/878-family capture card (PCI).

Because the unprivileged user cannot complete the chain alone, this is Low severity, not a privesc: the payoff for the root actor is silent kernel-memory corruption of its own kernel. It is nonetheless a genuine use-after-free lifetime defect in the module whose sole job is lifetime management, with a deterministic multi-megabyte write sink.

Why not reproduced on the guest (and what was verified instead)

• build.log/run.log: trigger compiles cleanly on the guest (DragonFly 6.5-DEVELOPMENT X86_64_GENERIC) and fails exactly at open("/dev/bktr0") → ENOENT.
• env.txt: pciconf -lv shows no Brooktree/Bt87x PCI device; devinfo has no bktr; /boot/kernel/bktr.ko and bktr_mem.ko exist (the modules load, but no probe ever attaches, so common_bktr_attach never runs).
• Fix validation is therefore not_testable on this guest (no baseline possible). The fix is a two-line source correction whose effect is provable by inspection: after it, the registry always holds either 0 or a live allocation.

Fix

fix.diff (against the read-only sys/ tree, never applied there): re-store the new buffer in the grow path, and clear the stored BUF address when the new allocation is bigger but the realloc fails/doesn't happen — keeping memory_list[unit].buf always pointing at the live bktr->bigbuf. (Related bookkeeping wart kept out of scope: on reload alloc_pages is reset to BROOKTREE_ALLOC_PAGES regardless of a prior grow — harmless over-allocation at worst, since grow only triggers when temp > alloc_pages.)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.