DF-5689 — idr_find()/idr_for_each() are lockless against idr_grow()'s kfree of the old node array (UAF read)

File: sys/libkern/linux_idr.c (pass 2) Class: kernel use-after-free read (memcorrupt / kernleak) Evidence class (per ID reservation): same-source userland race harness with a poisoned kfree canary (the guest has no ASAN), stock vs fixed source from /usr/src.

Build (on the DragonFly guest, as root)

sh build.sh     # builds df5689_race_stock (pristine linux_idr.stock.c,
                # md5 2d66ecf755e254d38a5c9e9e63992eaa)
                # and df5689_race (/usr/src/sys/libkern/linux_idr.c —
                # stock for the baseline phase, fixed after fix.diff is
                # applied for the validation phase)

Run

./df5689_race_stock 15            # baseline: 2 find-threads + writer cycling
                                  # grow 255->511->1023->2047 (3 kfrees/cycle)
./df5689_race_stock 10 foreach    # adds the idr_for_each reader (usually
                                  # SIGSEGVs: OOB read past the freed old
                                  # array — for_each caches nodes but re-reads
                                  # idr_count each iteration)
./df5689_race 15                  # fixed source: same load, expect zero hits

Expected

• stock: within seconds — UAF-READ: idr_find(<id>) returned data from a FREED idr_nodes array (0xdddddddddddddddd) (the shim allocator poisons every kfree'd chunk; that pointer value can only be observed by reading freed memory). Observed on every baseline round; the for_each variant additionally crashes with SIGSEGV (out-of-bounds read past the freed chunk).
• fixed (fix.diff: idr_find takes idr_token; idr_for_each takes idr_token and tests leaf state): zero hits across 37.4M racing idr_find calls in 3 rounds (14.6M/13.3M/9.5M) against 102k poisoned grow-kfrees.

In-kernel meaning

idr_find() returns nodes[id].data from the freed array — i.e. a stale kernel object pointer read from freed slab memory is handed back to the caller. In-tree unguarded consumer: i915_gem_object_lookup_rcu() (sys/dev/drm/i915/i915_gem_object.h:307-314) calls idr_find() under rcu_read_lock() only (sys/dev/drm/i915/i915_gem.c:4532-4533, 4971-4972); DragonFly kfree() has no RCU grace period, so the Linux RCU argument does not transfer. The stale struct drm_i915_gem_object * then flows into i915_gem_object_get_rcu()/use — a UAF-deref of attacker-influenceable slab content (object confusion), plus a kernel-pointer disclosure primitive (freed-chunk contents returned through the ioctl).

The guest has no GPU (/dev/dri absent), so the i915/ioctl-level chain cannot be driven there; the same-source race harness is the reserved evidence class for this file and establishes the UAF read conclusively (poison canary + OOB-SEGV manifestation).

Files

• df5689_race.c the race harness (includes the real linux_idr.c)
• linux_idr.stock.c pristine copy of the audited source
• shim/ userland stub headers (tokens = recursive pthread mutexes; kfree poisons)
• run.*.log baseline and fix-validation outputs
• fix.diff validated fix (same diff as DF-5688's — shared file)

DF-5689 VERDICT

Bottom line

REPRODUCED — certain. idr_find() (sys/libkern/linux_idr.c:515-528) and idr_for_each() (linux_idr.c:530-546) read idp->idr_count / idp->idr_nodes / the node array without taking idp->idr_token, while idr_grow() — invoked under the token from idr_pre_get() (linux_idr.c:275) and idr_alloc() (linux_idr.c:375) — swaps idp->idr_nodes and kfree()s the OLD array (linux_idr.c:449-459). A concurrent lockless reader that has loaded the old array pointer dereferences freed memory: idr_find() returns whatever the freed slab chunk contains as a kernel object pointer (UAF read), and idr_for_each() — which caches the nodes pointer once (linux_idr.c:537) but re-reads idp->idr_count every iteration (linux_idr.c:538) — walks past the end of the freed old array (OOB read; the rig's for_each variant dies with SIGSEGV against the stock source).

Evidence (same-source rig, kfree-poison canary):

• baseline (pristine source, md5 2d66ecf755e254d38a5c9e9e63992eaa): UAF-READ: idr_find(N) returned data from a FREED idr_nodes array (0xdddddddddddddddd) — 3/3 rounds, hit after 30k–10M finds; the value 0xDDDD… can only be observed by reading a chunk after its kfree. for_each variant: SIGSEGV (OOB read past the freed chunk).
• fixed source (fix.diff: token-held idr_find/idr_for_each + __idr_find for the already-serialized idr_get_next): zero hits in 3 rounds totaling 37.4M racing finds against 102k grow-kfrees. (fix-race.log)

In-tree exposure (lock discipline vs the drm consumers)

• Unguarded: i915_gem_object_lookup_rcu() (sys/dev/drm/i915/i915_gem_object.h:307-314) — idr_find() under rcu_read_lock() only (i915_gem.c:4532-4533, 4971-4972). DF kfree() has no RCU grace period; the stale drm_i915_gem_object * flows into refcount/use — object confusion on freed slab content, and a kernel-pointer disclosure through the ioctl path.
• Guarded by external locks (safe today, fragile by design): drm_syncobj find (syncobj_table_lock, drm_syncobj.c:88-91), drm_gem lookup (table_lock, drm_gem.c:625-628), mode objects (idr_mutex, drm_mode_object.c:132-133), dp aux (aux_idr_mutex). The internal-token design invites the Linux-style "rcu-lookup" pattern that i915 already uses — the API must either take the token itself or document/enforce external locking.

Exploitation ceiling

The primitive is a read of freed kernel heap returned as an object pointer: (a) info-leak of freed-slab contents (stale object pointers + whatever the groomer left there) through any ioctl that reports the looked-up object; (b) object confusion — attacker grooms the freed 4KB/8KB chunk (M_IDR) so the stale data field points at attacker-chosen kernel memory, then the i915 path operates on a fake object. Full uid=0 was not pursued (no /dev/dri on the audit guest; the same-source rig is the reserved evidence class). The race window is a single load-to-dereference gap but the attacker controls both the allocation cadence (grow rate) and the lookup rate, and the rig shows reliable hits within seconds of userland-grade threading.

Fix

fix.diff (shared with DF-5688, same file): idr_find() takes idp->idr_token around an internal __idr_find(); idr_for_each() takes the token around the scan; idr_get_next() (the drm shim that already holds the token) is switched to __idr_find(). Validated: 37.4M racing finds, zero hits (vs 3/3 baseline hits).

Key references

• sys/libkern/linux_idr.c:515-528 (lockless idr_find)
• sys/libkern/linux_idr.c:530-546 (lockless idr_for_each; :537 cached pointer, :538 fresh count)
• sys/libkern/linux_idr.c:421-461 (idr_grow), :449-459 (swap + kfree of old array)
• sys/libkern/linux_idr.c:275, 375 (grow call sites under the token)
• sys/dev/drm/i915/i915_gem_object.h:307-314; sys/dev/drm/i915/i915_gem.c:4532-4533, 4971-4972 (unguarded consumer)
• sys/dev/drm/include/linux/idr.h:104-121 (idr_get_next, token-held)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.