DF-5273 evidence pack — cdioctl() refcount burn on interrupted hold

Finding (one line)

cdioctl() (sys/bus/cam/scsi/scsi_cd.c:1930-1934) reacts to a cam_periph_hold(periph, PCATCH) failure — which cam_periph_hold() itself already unwinds internally (cam_periph.c:395 acquire, :402 release) — with an extra, unmatched cam_periph_release(periph). Every signal-interrupted ioctl attempt therefore decrements the peripheral refcount by one: the refcount can be driven to 0 and negative on a valid, open device, and — when the periph is later invalidated — the CAM_PERIPH_INVALID && refcount == 1 branch of cam_periph_release() (cam_periph.c:352-357, 371-374) frees the periph (softc, disk, sysctls) while file descriptors are still open → use-after-free window in cdioctl/cdclose between cam_extend_get() and cam_periph_lock().

Reproduce (guest, root; evilcd kld loaded)

cd /root/df5271 && cc -O -o poc_ref poc_ref.c
timeout 45 usched :1 ./poc_ref /dev/cd1

Expected (vulnerable kernel)

[poc] initial cd periph refcount: 1
[poc] round 0 burn 0: ioctl rc=-1 errno=4(Interrupted system call)  refcount=1
[poc] round 0 burn 1: ioctl rc=-1 errno=4(Interrupted system call)  refcount=0
[poc] round 0 burn 2: ioctl rc=-1 errno=4(Interrupted system call)  refcount=-1

One burned reference per EINTR-interrupted ioctl; no close() anywhere. (The holder child keeps the periph held via a device-stalled CDIOCPAUSE; the parent's CDIOCPLAYMSF blocks in cam_periph_hold and is self-interrupted with SIGALRM after 100 ms — sigaction installed without SA_RESTART so the sleep returns EINTR.) Across earlier exploratory runs the refcount reached -3 and -5 the same way; debug.evilcd.refcnt reads the live periph's refcount field directly.

Why it matters

cam_periph_hold()'s acquire/release is balanced by design; the extra release in cdioctl's error path is the only unbalanced drop in the driver's ioctl path (contrast cdopen() scsi_cd.c:1017/1028-1031, which does acquire before holding, making its failure path balanced). Effects: - refcount underflow (demonstrated: 1 → 0 → -1); - with the device invalidated (unplug) and refcount == 1 at release time, camperiphfree() runs with open fds → subsequent ioctl/close race the free between cam_extend_get() (scsi_cd.c:1918) and cam_periph_lock (scsi_cd.c:1922) → UAF on periph/softc.

Not escalated further here: the trigger set (privileged open + concurrent holder + timed signal + hot-unplug) makes the full UAF racy; the refcount underflow itself is deterministic and is demonstrated.

Files

• poc_ref.c — self-contained fork-based PoC (holder child + timed SIGALRM burns + refcount reads).
• evilcd.c — the fake CD (stalls CDIOCPAUSE; debug.evilcd.refcnt, debug.evilcd.unstall).
• run.log (see DF-5271 pack for the shared rig logs), refcount_burn.log — the decisive output above.
• fix.diff — one-line fix (delete the unmatched release).

Fix

--- a/sys/bus/cam/scsi/scsi_cd.c
+++ b/sys/bus/cam/scsi/scsi_cd.c
@@ -1931,7 +1931,6 @@ cdioctl(struct dev_ioctl_args *ap)
    if ((error = cam_periph_hold(periph, PCATCH)) != 0) {
        cam_periph_unlock(periph);
-       cam_periph_release(periph);
        return (error);
    }

(cam_periph_hold already drops its own acquire on failure.)