DF-5301 — uhub_child_location_string/pnpinfo_string TOCTOU: NULL usb_hub* deref (and UAF) during hub detach

What

uhub_child_location_string() and uhub_child_pnpinfo_string() (sys/bus/u4b/usb_hub.c:1660-1757) validate the hub device with device_is_attached(parent) and then dereference sc->sc_udev->hub — a pointer that uhub_detach() (sys/bus/u4b/usb_hub.c:1592) sets to NULL (and kfrees at :1590) while the newbus device is still DS_ATTACHED: in DragonFly's device_detach() (sys/kern/subr_bus.c:2129-2153) the state only becomes DS_NOTPRESENT after DEVICE_DETACH() returns (and after device_printf(dev, "detached\n") and devclass bookkeeping).

A reader that passes device_is_attached() and then reads hub == NULL crashes in uhub_find_iface_index():

sys/bus/u4b/usb_hub.c:1637
    nports = hub->nports;      /* hub == NULL -> kernel NULL-deref panic */

A reader that lands between kfree(hub) (:1590) and the NULL store (:1592) gets a use-after-free read; readers that resolve bus->devices[up->device_index] without usb_ref_lock (usb_bus_port_get_device(), sys/bus/u4b/usb_hub.c:2190-2201) can additionally walk a freed usb_device (usbd_get_iface, serial string in %pnpinfo) — heap data from freed objects can surface in the user-readable string.

Reachability (unprivileged)

The methods are dispatched from bus_child_location_str() / bus_child_pnpinfo_str() (sys/kern/subr_bus.c:3434-3460), which are called from world-readable sysctls:

• dev.<devclass>.<unit>.%location / %pnpinfo — per-device text sysctls (sys/kern/subr_bus.c:209-218), e.g. dev.uhid.0.%location where uhid0's parent is the detaching uhub1.
• hw.bus.devices — the global unlocked device-tree walk (sys/kern/subr_bus.c:3873-3905) which formats location+pnpinfo for every device in the system.

No privilege is needed to read these. The racing kernel side is any hub detach: physical unplug on real hardware, or (in this repro) QEMU monitor device_del of an emulated hub.

Repro environment

• Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC), 6 vCPU KVM.
• QEMU started with -device piix4-usb-uhci,id=uhci0 (QEMU_EXTRA="-device piix4-usb-uhci,id=uhci0" dfbsd-qemu/vm.sh up).
• Devices via monitor:
• device_add usb-hub,id=h1,bus=uhci0.0,port=1 -> guest uhub1
• device_add usb-tablet,id=ta,bus=uhci0.0,port=1.1 -> uhid0 (child of uhub1)
• device_add usb-tablet,id=tb,bus=uhci0.0,port=1.2 -> uhid1 (child of uhub1)
• Verify dispatch: sysctl dev.uhid.0.%location prints bus=0 hubaddr=2 port=1 devaddr=3 interface=0 ugen=ugen0.3 — served by uhub1's uhub_child_location_string.

Files

• hammer.c — unprivileged reader storm (threads hammering the vulnerable sysctls + the global walk), built/run as regular user maxx.
• replug.py — host-side replug driver (monitor device_del/add cycle).
• build.sh, run.sh — exact commands.
• run.log, panic.txt, boot-snippet.txt — runtime evidence.
• fix.diff — post-verification fix (NULL-guard hub in both methods), never applied to the repo sys/ tree.

Expected result

Kernel panic (Fatal kernel mode data access fault / NULL deref in uhub_find_iface_index) while the hammer runs and a hub replug cycle lands in the window; guest drops to DDB, ssh dies. It is a race — see VERDICT.md for hit-rate math and observed cycles.

DF-5301 VERDICT — uhub_child_location_string/pnpinfo_string TOCTOU

Status: not_reproduced (code defect certain; exploitable interleaving not closed on this kernel after an extensive, instrumented campaign).

The defect (source-certain)

uhub_child_location_string() (sys/bus/u4b/usb_hub.c:1660) and uhub_child_pnpinfo_string() (:1702) do:

if (!device_is_attached(parent)) { ... return; }   /* usb_hub.c:1668 */
sc  = device_get_softc(parent);                    /* :1674 */
hub = sc->sc_udev->hub;                            /* :1675 */
uhub_find_iface_index(hub, child, &res);           /* :1677 -> :1637 nports = hub->nports */

device_is_attached() is dev->state >= DS_ATTACHED (sys/kern/subr_bus.c:1902-1905). In DFly's device_detach() (sys/kern/subr_bus.c:2129-2153) the state stays DS_ATTACHED for the whole duration of DEVICE_DETACH() and until after device_printf(), devremoved(), devclass_delete_device() — i.e. the guard returns TRUE during the entire body of uhub_detach() and for a tail of ~100-300 µs after it. But uhub_detach():

kfree(hub, M_USBDEV);          /* usb_hub.c:1590 — hub freed */
sc->sc_udev->hub = NULL;       /* usb_hub.c:1592 — hub NULLed */

inside that window. A reader between the check and the deref gets either a freed struct usb_hub * (UAF read; hub->ports, hub->hubudev at :1639-1640) or NULL (kernel NULL-deref panic at :1637). Additionally usb_bus_port_get_device() (sys/bus/u4b/usb_hub.c:2190-2201) reads bus->devices[up->device_index] without usb_ref_lock and without a reference, so the port walk inside uhub_find_iface_index() can chase a usb_device that usb_free_device() (sys/bus/u4b/usb_device.c:2138-2224) has cleared and kfree'd, feeding freed-heap-derived values into the user-readable location/pnpinfo strings.

Entry points (verified live on the guest):

• dev.uhid.0.%location → bus=0 hubaddr=2 port=1 devaddr=3 interface=0 ugen=ugen0.3 — served by uhub1's uhub_child_location_string — world-readable.
• hw.bus.devices global walk (sys/kern/subr_bus.c:3873-3905) calls both methods for every device — world-readable.

Reproduction attempt (extensive)

Environment: DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC (Jul 2 2026), 6 vCPU KVM, QEMU -device piix4-usb-uhci,id=uhci0 with usb-hub on root port 1 (uhub1, 8 ports) and two usb-tablet children on ports 1.1/1.2 (uhid0, uhid1 — children of uhub1).

• Reader storm as unprivileged user (maxx, no groups): 60 threads tight-looping the four vulnerable sysctls plus a global walk thread — sustained ~155,000-190,000 successful dispatches/s while the hub exists (hammer-tail.log).
• Host-side replug loop (QEMU monitor): device_del h1 / re-device_add of hub+tablets — 953 full uhub_detach windows generated (detach_count.txt), each producing the kfree(hub)/hub=NULL transition with the device still DS_ATTACHED.
• Four campaigns (replug3/replug4 logs): 400 + 300 cycles at full load, plus ~350 earlier cycles with a diluted hammer.

Result: no panic, no fault, guest stayed up through every window.

Why the interleaving does not close (traced)

1. OID lifecycle kills fresh lookups at the window. The children (uhid0/uhid1) are torn down in uhub_detach()'s port loop (:1567-1579) before kfree(hub). Their sysctl OIDs are removed (device_sysctl_fini inside device_detach of each child) ~1-2 ms before hub=NULL. At the vulnerable instant (after :1592) fresh sysctl lookups return ENOENT — dispatch rate to the vulnerable method is zero exactly when hub is NULL.
2. In-flight readers cannot be stalled in the check→deref interval. The interval is ~10-50 ns of straight-line code with no blocking call and no lock. DFly LWKT does not preempt a kernel-resident thread for an equal-priority (user) thread; only an interrupt can delay it, and the delay window (~ns-µs) must contain the single hub=NULL store executing on another CPU — measured/estimated rate ≈1e-7/s. (The oid_running drain in sysctl_remove_oid_locked that would have serialized this cleanly — kern_sysctl.c:387-397 — is dead code in this tree: the counter is never incremented.)
3. The global walk re-derives pointers after every sleep. sysctl_devices walks the unlocked bus_data_devices TAILQ and calls the methods per device, but its only blocking points (SYSCTL_OUT copyouts) lie between devices; after each copyout the iterator reloads TAILQ_NEXT and devremoved() has already unlinked the detaching children, so post-stall iterations skip them.

The residual reachable window is thus interrupt/SMP alignment of a single store inside a ~10 ns instruction gap — not demonstrable. (Under a kernel change that inserts any blocking point between device_is_attached() and the hub load — or a reader that holds the values longer — the defect becomes a NULL-deref panic/UAF-read.)

Fix

fix.diff (applies clean against sys/bus/u4b/usb_hub.c): NULL-guard hub after the device_is_attached() check in both methods. This converts any future interleaving into a benign empty string. Fix validation (patched-kernel build + re-run) was not performed: the baseline race never reproduced, so there is no observable to diff against; the guard is a trivially-correct hardening (fix_status: not_testable).

Bottom line

Real missing-synchronization defect (CWE-367 + CWE-476/CWE-416 pattern), certain in source, reachable only through sysctl reader paths that are world-readable, but the exploitable interleaving window collapses to ~nothing on this kernel because of the sysctl OID lifecycle and DFly's non-preemptible straight-line kernel intervals. Filed as hardening with a one-line-per-callsite fix. No impact demonstrated; not a practical DoS on this system as built.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.