DF-5253 VERDICT — uaudio mixer sysctl handler lifetime race (REPRODUCED, panic)

Status

reproduced — stock-kernel panic under the exact code path cited, on the DFBSD QEMU guest with an emulated USB audio device; fix validated (panic gone).

• impact: panic (kernel NULL-deref in lockmgr on the sysctl write path; the class is a lock-lifetime TOCTOU — with allocator luck the same window is a freed-lock lockmgr, i.e. UAF-write potential — but the NULL store in uaudio_mixer_uninit_sub() makes the deterministic outcome a NULL deref).
• severity assigned: Low — the racing sysctl write requires privilege (SYSCAP_NOSYSCTL_WR gate at sys/kern/kern_sysctl.c:1446-1450), so the practical trigger is "root process writes a uaudio mixer sysctl while the device is unplugged". Unprivileged users cannot reach the wide window (their writes fail EPERM before the handler runs; reads return before the second lockmgr). Still a real kernel defect: a legitimate privileged sysctl write racing an unplug panics the kernel.

Root cause (path:line)

sys/bus/u4b/audio/uaudio.c:2736 uaudio_mixer_sysctl_handler():

2748:   if (sc->sc_mixer_lock == NULL)
2749:       return (ENXIO);
2753:   lockmgr(sc->sc_mixer_lock, LK_EXCLUSIVE);   /* use #1 */
...     /* walk sc->sc_mixer_root */
2764:   lockmgr(sc->sc_mixer_lock, LK_RELEASE);
2766:   error = sysctl_handle_int(oidp, &temp, 0, req);  /* crosses user memory: unbounded sleep */
2767:   if (error != 0 || req->newptr == NULL)
2768:       return (error);
2772:   lockmgr(sc->sc_mixer_lock, LK_EXCLUSIVE);   /* use #2 — re-reads the field! */
2777:   pmc->wData[chan] = temp;                     /* stale pmc write */

Teardown chain, all while the mixer sysctl OIDs are still registered (they are children of the pcm device's sysctl ctx, freed only afterwards in device_sysctl_fini(), sys/kern/subr_bus.c:234-240):

• uaudio_detach() (uaudio.c:1192) → bus_generic_detach() (:1214)
• → ua_detach → uaudio_detach_sub() (uaudio.c:1166) → pcm_unregister()
• → mixer_uninit() (sys/dev/sound/pcm/mixer.c:767):
• MIXER_UNINIT(m) (:809) → ua_mixer_uninit → uaudio_mixer_uninit_sub() (uaudio.c:5378) → sc->sc_mixer_lock = NULL (:5385)
• snd_mtxfree(m->lock) (:811) → lockuninit + kfree of the 32-byte M_DEVBUF struct lock (sys/dev/sound/pcm/sound.c:92-108)
• kobj_delete((kobj_t)m) (:812) frees the snd_mixer
• only then: device_sysctl_fini() → sysctl_ctx_free() removes the OIDs.

So for the whole duration of mixer_uninit() + the tail of the pcm child detach, dev.pcm.X.mixer.*.val OIDs resolve and dispatch into the handler, whose second lockmgr re-reads a field that has just been NULLed/freed. Handler dispatch is serialized against OID removal by the global sysctllock (shared in handlers, exclusive in ctx teardown) — but nothing serializes the handler against sc_mixer_lock's lifetime.

How it was proven (chronological, honest)

1. Booted the guest with QEMU's emulated USB audio device on a PIIX3 UHCI controller: real uaudio0 + pcm0 attach, real mixer sysctls (dev.pcm.0.mixer.vol_0_0.val etc.).
2. Unprivileged hammer (hammer.c, 8 × in-process sysctlbyname read+write, ~1.4M ops/s) + 100+ monitor device_del/device_add cycles: no crash.
3. Instrumented uaudio.c on the guest (probe only: print when a handler reaches the 2nd lockmgr with the field NULL; print each uninit free): 20 cycles with the unprivileged hammer → 20 frees, 0 traversals.
4. Root-cause of (2)/(3): sysctl writes are gated by caps_priv_check(SYSCAP_NOSYSCTL_WR) at kern_sysctl.c:1446 — unprivileged sysctlbyname(..., newp, ...) returns EPERM before the handler runs, so req->newptr is never non-NULL for them and the 2nd lockmgr is unreachable.
5. Same instrumented module + hammer run as root (write path live): 8 cycles → DF5253: RACE HIT: handler reached 2nd lockmgr after teardown (pmc=0xfffff80117b6aa00 chan=1) — traversal proven on the real driver.
6. Stock module restored, rebooted, root hammer + 10 cycles → kernel panic (panic.txt): Fatal trap 12, fault VA 0x8, Stopped at lockmgr_release+0x11: movq 0x8(%rdi),%rsi — i.e. lockmgr(NULL), exactly the cited use.
7. Fix validation: applied fix.diff (uaudio-owned sysctl ctx, freed in uaudio_detach() before bus_generic_detach(), which drains in-flight handlers via the sysctllock; plus a defensive NULL re-check in the handler), rebuilt uaudio.ko, installed, rebooted, root hammer + 25 cycles → zero panics, guest healthy, mixer functional after replug.

Side observation (different subsystem, root-triggered, out of scope for this file): kldunload uaudio once panicked in sndstat_sysuninit → sbuf_delete ("sbuf_delete called with uninitialized or corrupt sbuf") via linker_file_unload — a sound.ko teardown bug worth its own ticket.

Exploit chain

Not applicable beyond panic: the reachable traversal requires a privileged sysctl writer, so this is not an unprivileged privesc primitive. With the NULL store removed (hypothetically), the same window would be a freed-lock lockmgr (32-byte M_DEVBUF UAF-write class), which is why the fix removes the window rather than relying on the NULL store.

kernel_refs

• sys/bus/u4b/audio/uaudio.c:2736-2786 (handler, both lockmgr uses)
• sys/bus/u4b/audio/uaudio.c:5378-5388 (uaudio_mixer_uninit_sub NULL store)
• sys/bus/u4b/audio/uaudio.c:1192-1227 (uaudio_detach ordering)
• sys/dev/sound/pcm/mixer.c:767-813 (mixer_uninit: MIXER_UNINIT → snd_mtxfree → kobj_delete)
• sys/kern/subr_bus.c:234-240 (device_sysctl_fini after driver detach)
• sys/kern/kern_sysctl.c:1446-1450 (write privilege gate — reachability limit)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.