mtw_attach error path before MTW_LOCK jumps to 'detach:' which does MTW_UNLOCK of a never-acquired lock (plus usb_callout_drain of a never-initialized callout) - lockmgr assertion/panic on malformed USB device
Summary
usbd_transfer_setup failure at :539-547 jumps to detach: whose first act is MTW_UNLOCK - but MTW_LOCK is first taken at :550, so LK_RELEASE without ownership trips lockmgr assertions/underflow (panic or corrupted lock state); detach also drains a ratectl_ch initialized only on the success path. USB device with MT7601U VID:PID whose descriptors fail transfer setup -> attach-time panic (evil-maid). detach_nolock label fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5265 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| env.txt | — | 183 B | view raw | |
| fix.diff | — | 170 B | view raw | |
| verdict.json | — | 2.6 KB | view raw |
Fix verification
not_testablefix.diff authored and verified with 'git apply --check' against the pristine sys/ tree, but cannot be kernel-tested: the guest has no USB controller and no MT7601U device model, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.
fix.diff (git-apply clean); VERDICT.md
Confirmed kernel references
Detail
Exploit chain
plug malformed/faulty USB device with MT7601U VID:PID -> usbd_transfer_setup fails -> MTW_UNLOCK of unheld lockmgr -> assertion failure/panic at attach
Evidence (decisive lines)
Code-cited: 541 goto detach with the only MTW_LOCK at 550; detach label at 692-693. VERDICT.md. untested (no USB device model in guest)
Verified recommended fix
Separate detach_nolock label for the pre-lock failure path
Verdict
If usbd_transfer_setup() fails (if_mtw.c:539-547) mtw_attach() jumps to 'detach:' at 692, which executes MTW_UNLOCK(sc) (693) although MTW_LOCK(sc) is first taken later, at 550 - releasing a lockmgr lock that was only MTW_LOCK_INIT'd (535). On DragonFly lockmgr an LK_RELEASE without ownership trips the lock-count assertions/underflow ('lockmgr: lks not held'/negative count) and panics or corrupts the lock state; mtw_detach() then also runs usb_callout_drain(&sc->ratectl_ch) (749) on a callout that is only usb_callout_init_mtx'd on the success path (685). Reachable by any USB device whose descriptors make usbd_transfer_setup fail while matching the MTW_VP table (needs a firmware-masked MT7601U VID/PID or damaged descriptors) at attach time. Hardware-gated in-kernel; not exercised on the guest.
No comments yet.