DF-5798 — unmount_allproc_cb manipulates p->p_textnch without p_token (exec race → refcount underflow/UAF)

What

unmount_allproc_cb() (sys/kern/vfs_syscalls.c:768-787) reads and drops p->p_textnch while holding only the allproc list token (via allproc_scan, kern_proc.c:1401) — not p->p_token. Every other p_textnch mutation site serializes under p_token:

• kern_exec.c:549-552: if (p->p_textnch.ncp) cache_drop(&p->p_textnch); if (nch->mount) cache_copy(nch, &p->p_textnch);
• kern_exit.c:498, kern_shutdown.c:599, kern_fork.c:541.

The unsynchronized pair (compare-then-drop in the callback vs drop-then-copy in exec) can interleave: the callback samples p->p_textnch.mount == mp on the OLD handle, exec then swaps in the NEW handle, and the callback's cache_drop() releases the new handle's references and zeroes it. The freshly-installed ncp/mount refs are then one too low → premature free of a live namecache entry / mount refcount skew → use-after-free. The callback runs on every retry-loop iteration of dounmount() (vfs_syscalls.c:931-947) for MNT_FORCE unmounts, so each umount -f attempt re-rolls the window up to 50 times.

Reachability: root by default (umount -f); unprivileged if vfs.usermount=1 (mount owner may force-umount their own mount).

Reproduce attempt (guest)

sh stress.sh   # 6 rounds: tmpfs on /mnt/df5798, 8x400 self-reexecing
               # binaries placed ON the mount, respawning cd-holder to
               # keep the retry loop iterating, 10x umount -f per round

~4.5 minutes, >100k execs, 60 umount -f attempts, 243 "nlookup: warning umount race avoided" messages (the namecache layer's own umount-race defusing for nlookup paths) — no panic, no crash. The p_textnch interleave window (compare→drop gap ~tens of ns must contain exec's entire drop+copy swap) was not hit.

Expected if the race is won

Refcount underflow on the new textnch ncp → delayed panic/UAF on later use (exec/exit/vp resolution). Not observed.

DF-5798 VERDICT — NOT REPRODUCED (speculative race, code-level case documented)

Bottom line

The race was exercised hard on the guest (6 rounds x (8x400 self-reexecing processes on the mount + respawning busy-holder + 10x umount -f), >100k execs, 60 force-unmount attempts, ~4.5 min) and did not manifest: no panic, no refcount divergence observed, guest stayed up (dmesg shows only the namecache layer's own "nlookup: warning umount race avoided" defusing, 243x — machinery that protects nlookup paths but NOT p_textnch). The code-level race remains: the unsynchronized compare-then-drop in unmount_allproc_cb() (vfs_syscalls.c:777-778) against exec's drop-then-copy (kern_exec.c:549-552) has an interleave that steals a reference from the newly installed handle. The window (callback's compare→drop gap must contain exec's full swap) is on the order of tens of nanoseconds against millisecond process lifetimes — likely why it did not trigger.

Why it is still reported (speculative)

• unmount_allproc_cb mutates p->p_textnch with no p_token; every other mutation site in the kernel (kern_exec.c:549, kern_exit.c:498, kern_shutdown.c:599, kern_fork.c:541) is serialized by p_token. The asymmetry is unambiguous in the source.
• The bad interleave is concrete: T1 reads p->p_textnch.mount == mp (old handle) → T2 (exec) cache_drop (zeroes) + cache_copy (installs new handle, takes refs) → T1 cache_drop(&p->p_textnch) drops the NEW handle's refs and zeroes it → the new ncp/mount refs are one too low → premature free of a namecache entry still reachable from the topology/vp → UAF on next touch (exec/exit/resolve).
• dounmount()'s retry loop (vfs_syscalls.c:888-963) re-runs the callback every iteration (up to 50 per attempt) whenever the mount stays busy, multiplying exposure per umount -f.
• Trigger privilege: root by default; unprivileged if vfs.usermount=1 (mount owner can force-umount their own mount — sys_unmount vfs_syscalls.c:648-665).

Evidence

• run.log — stress trace: STRESS-DONE, mount cleaned up, no panic.
• dmesg.txt — 243x "nlookup: warning umount race avoided" (proves heavy umount racing occurred; that warning path is nlookup-specific).
• reexec.c, stress.sh — the rig.

Fix validation

Not performed (nothing reproduced to validate against). fix.diff is the one-line-token fix: take p_token around the p_textnch drop and re-check the condition under the token.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.