DF-5765 — iconv_xlat cspair lifetime handoff race → kernel heap corruption (panic: BADFREE2)

What

sys/libiconv/iconv_xlat.c claims and drops its cspair lifetime reference (csp->cp_refcount++ at iconv_xlat.c:63 inside iconv_xlat_open, csp->cp_refcount-- at iconv_xlat.c:73 inside iconv_xlat_close) with no synchronization, while the cspair teardown paths (iconv_sysctl_add error path, iconv.c:439-442; iconv_mod_unload, iconv.c:85-95) free cspairs and their tables under iconv_lock — a lock that iconv_open()/iconv_close() (iconv.c:233-273) never take. A racing open can find a pair, sleep in kobj_create(M_WAITOK) (iconv_xlat.c:60), and then write cp_refcount++ into freed memory and cache a dangling d_table; the add error path frees the pair unconditionally, even when a counted reference is held.

Reproduce (inside the DragonFly guest, as root)

cd /root/xlatrace   # == findings/poc/DF-5765/ transferred into the guest
sh build.sh         # copies VERBATIM production iconv.c/iconv_xlat.c
                    # (md5s recorded in setup.log), builds
                    # xlatrace_harness.ko + userland hammer
kldload ./xlatrace_harness.ko
sh run.sh           # baseline, then 2 x 8,000,000-iteration races

run.sh starts kernel racer threads (one per CPU except CPU0) that call the production iconv_open/iconv_convstr/iconv_close on the pair zz9to:zz9from in a loop, while the userland hammer drives the production kern.iconv.add sysctl with ia_datalen=256, ia_data=0x1000 (unmapped ⇒ copyin EFAULT ⇒ production error path registers the pair, allocates the 256-byte table, then unregisters and kfrees both, in a tight loop).

Expected / observed

• Unpatched: within seconds-to-minutes of churn:
• console: [xlatrace] PROOF: live handle d_csp=... refcount=-2046 -- pair freed/reused under the open (d_table=...)
• then panic: BADFREE2 at _kfree+0x593 called from iconv_sysctl_add+0x172 (the production error path freeing a chunk whose freelist the racers' writes corrupted); ssh dies, vm.sh status ⇒ down.
• 3/3 race sessions panicked with the identical signature (run.log, run.2.log, panic.3-stale-build.txt).
• With fix.diff applied to the rig's verbatim production iconv.c: full run.sh completes (FIX_RUN_RC=0), 21.3M cumulative opens, DANGLING=0, kern.iconv.cslist shows no refcount anomalies, no panic (run_fixed.log). Positive control: a valid add still works (csid=1) and racers perform balanced open/conv/close cycles on it.

Files

• harness.c — KLD rig (production sources compiled in verbatim)
• hammer.c — userland sysctl-churn driver (-l dumps cslist/drvlist)
• Makefile, build.sh, run.sh, xfer.sh
• run.log, run.2.log — decisive unpatched runs (console captures)
• panic.txt, panic.2.txt, panic.3-stale-build.txt — panic captures
• run_fixed.log, fix_build.log — fix-validation run
• setup.log — verbatim-source md5s; env.txt — guest environment
• VERDICT.md, manifest.json, verdict.json, fix.diff

Impact

Privilege analysis: BOTH sides of the race are root-gated on a stock system — writing kern.iconv.add requires SYSCAP_NOSYSCTL_WR (kern_sysctl.c:1446-1447) and the iconv_open side is only reachable from mount(2)-time VFS charset setup (root; vfs.usermount=0 default). So: privileged-user-triggerable kernel heap corruption / DoS — severity Low per the audit rubric ("already-privileged user"), CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H (3.3).

DF-5765 — VERDICT

Status: reproduced (panic). Fix validated (fixed).

The finding (pass 2 on sys/libiconv/iconv_xlat.c, beyond DF-2247/2248/2249/5746)

The known trio covers sizing bugs of the flat converter (table length unvalidated at open; min() truncation; convchar==1 unchecked). What remained in the 125 lines was lifetime: iconv_xlat_open/iconv_xlat_close are the only code that claims and releases a cspair's existence guarantee, and they do it unsynchronized:

• iconv_xlat.c:60-64 — kobj_create(M_WAITOK) (sleeps), then dp->d_table = csp->cp_data (:61), then csp->cp_refcount++ (:63).
• iconv_xlat.c:73 — dp->d_csp->cp_refcount--.
• Callers never hold iconv_lock: iconv_open walks iconv_cslist unlocked (iconv.c:243 via iconv_lookupcs :163-176) and dispatches the open method at iconv.c:245/:264; iconv_close at iconv.c:269-273.
• The freeing paths hold iconv_lock: iconv_sysctl_add error path iconv.c:439-442 → iconv_unregister_cspair (:218-225: TAILQ_REMOVE + kfree(cp_data) + kfree(csp)), and iconv_mod_unload (:85-95, same free via refcount==0 check that the unlocked ++ can hide from).
• Aggravator: the add error path frees unconditionally — it never checks cp_refcount — so even a correctly counted reference does not protect the pair (this is why the fix needed two parts; see below).

Verification (guest-live, production-code KLD rig)

Rig: xlatrace_harness.ko compiles the verbatim production iconv.c + iconv_xlat.c (md5s in setup.log) and drives them exactly as production does:

• racer kthreads = the VFS-mount role: production iconv_open() → iconv_convstr() → iconv_close() on pair zz9to:zz9from;
• userland hammer (root) = the sysctl role: production kern.iconv.add with ia_datalen=256, ia_data=0x1000 (unmapped) ⇒ production copyin EFAULT ⇒ production bad: path registers, allocates a full-size table, then unconditionally unregisters/frees, in an 8M-iteration loop per round.

Observed (unpatched) — 3/3 race sessions:

1. Dangling handoff probe (harness-side read-only check right after a successful production open: the handle's cspair refcount must be ≥1): fired with refcount=-2046 / -2047 / -204 (cleanest capture in panic.3-stale-build.txt): [xlatrace] PROOF: live handle d_csp=0xfffff80116c2bae0 refcount=-2046 -- pair freed/reused under the open (d_table=0xfffff8008da91600) — i.e. the pair was freed under the live handle and ~2×10³ subsequent decrements landed on the reused chunk.
2. panic: BADFREE2 at _kfree+0x593 ← iconv_sysctl_add+0x172 (production kfree of allocator-state-corrupted memory), ssh dies, vm.sh status ⇒ down. Identical signature across runs (cpuid 2, 5, 2, 3).

The unpatched runs never completed run.sh (panic mid-round), so the in-guest run.log was lost each time; the serial console captures (run.log, run.2.log, panic*.txt) are the runtime evidence.

Primitive characterization / uid=0?

The corruption primitive is a kernel-heap freelist corruption (small, partially controlled ±1 writes at a predictable offset in a freed 64-112B chunk, repeatable millions of times, leading to BADFREE2). But the escalation chain is closed by construction: both sides of the race are root-gated on a stock system —

• kern.iconv.add writes require caps_priv_check(SYSCAP_NOSYSCTL_WR) (kern_sysctl.c:1446-1447);
• iconv_open() is only reachable from mount(2)-time charset setup (cd9660/msdosfs/smbfs), root-only with vfs.usermount=0 (default).

An unprivileged user can drive neither side; a hard-blocked prerequisite (privilege on both fronts) — so impact ceiling = privileged-user-triggered kernel memory corruption / DoS. Severity Low per rubric ("already-privileged user"), impact=panic.

Fix validation (mandatory for memcorrupt) — fixed

fix.diff (git-apply-able vs sys/libiconv/iconv.c, authored after verification, never applied to the read-only tree) has two parts:

1. serialize the handoff: iconv_open()/iconv_close() hold iconv_lock LK_EXCLUSIVE across lookup+converter-open / converter-close (both direct and composite open paths);
2. stop freeing referenced pairs: iconv_sysctl_add copies the table in before publishing the cspair, and its bad: path only reaps the pair when cp_refcount == 0.

Honest detour: fix iteration 1 contained only part 1; the first validation attempt still panicked. Investigation showed that session (and one other) had loaded a stale build due to a MAKEOBJDIRPREFIX objdir mixup between build.sh and the rebuild (proven behaviorally: under part 2's copyin-before-publish, successful opens during pure-EFAULT churn are impossible — and a verified-clean rebuild shows exactly opens=0 — yet those runs showed successful opens). With the objdir fixed and the source patch verified (grep ndata iconv.c, fresh single-objdir build), the complete fix was validated:

• short race: 4M hammer iterations + racers ⇒ opens=0 DANGLING=0, no panic, cslist: 0 bytes (nothing published, nothing orphaned);
• positive control: a valid kern.iconv.add (real 256-byte table) still succeeds (csid=1); racers performed 774k/257k balanced open/conv/close cycles on it, DANGLING=0, final refcount 0;
• full run.sh (baseline + 2×8M race rounds): FIX_RUN_RC=0, cumulative opens=21335040 convs=21335040 closes=21335040 DANGLING=0, final cslist 1 pairs, all refcounts 0, no panic (run_fixed.log).

Baseline-vs-patched table:

Negative results (what I checked and killed in this file)

• iconv_xlat_conv byte-index and length math beyond the known trio: with a full-size table the loop is exactly 1:1, *inbytesleft -= n cannot underflow for the min() path (n ≤ both), casetype != 0 returns −1 cleanly (xlat has no case support; callers use xlat16 for that), NULL inbuf/outbuf handled (:88-89).
• kobj_create(M_WAITOK) cannot fail-with-NULL here (M_WAITOK).
• d_table aliasing csp->cp_data is sound if the lifetime claim were synchronized — which is exactly the finding.
• No unprivileged entry: sysctl write privilege gate + mount-only open path (see above), so no uid=0 chain exists for this bug.

bt_input.c / hda_acer_c720_patch.c (same batch)

• sys/netbt/bt_input.c: current tree is still the pre-DF-5752-fix state — producers netisr_queue(NETISR_BLUETOOTH, m) at hci_unit.c:437/459/481/543, btintr (bt_input.c:32-40) ignores the netmsg and drains all units via hci_intr. DF-5752 owns the queue contract, DF-5754 owns the walk-vs-detach UAF (hci_unit.c:126-129). Beyond those two: netisr_register(NULL hashfn) is safe (netisr.c:543-544 defaults it), netbt's MOD_UNLOAD returns EBUSY (bt_proto.c:48-49) so no dangling netisr handler, and the mplock wrap matches netbt's lock discipline — nothing new in 41 lines.
• sys/gnu/dev/sound/pci/hda/hda_acer_c720_patch.c: clean. The patch is gated on codec id ALC283 and Acer C720 subvendor ids (hdaa_patches.c:786-790, values from hardware config space), applied only at codec configure/reinit (hdaa.c:6226, :6563) — the attacker is malicious/buggy physical hardware. hdaa_widget_get is bounds-checked (hdaa.c:1673-1678) and NULL-checked (:195); the wclass.pin.config read (:196) is a union of scalars only (hdaa.h:122-134 — no pointer disclosure); all coefficient writes are fixed constants through hda_command whose return codes the codec can NAK without kernel-state consequence; the tsleep blocks are #if 0. No software-reachable input, no memory-safety defect.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.