DF-5833 PoC — coredump LWP-set race → elf_puttextvp vnh_max underflow → cb_put_fp heap overflow

Unprivileged (uid 1001) rig for the size-precompute race in generic_elf_coredump() (sys/kern/imgact_elf.c).

Components

Build (on guest)

cc -O2 -Wall -o eater eater.c
cc -O2 -Wall -o victim victim.c -lpthread
cc -O2 -Wall -o dripper dripper.c
cc -O2 -Wall -o parse_core parse_core.c
cc -O2 -Wall -o parse2 parse2.c

Run

sh controller.sh stage1 5   # benign: successful core with extra NT_PRSTATUS
sh controller.sh ckpt2 6    # reservation-overrun attempts (root first: sysctl -w kern.ckptgroup=-1)

Each attempt (~20-90 s): eater pins free memory → victim releases workers whose lwp_create calls park mid-creation → victim triggers the core dump (SIGSEGV, or sys_checkpoint for the no-prelude path) → the dumper's DRYRUN sizes the header → dripper feeds pages → parked lwp_create calls complete and insert LWPs into the tree while the dump is between its two passes → the WRITE pass needs more note space than reserved.

Expected observations (see run.final.log)

• children counts grow across snapshot → DRYRUN → WRITE (LWP insertion mid-dump): "race += 14..29" per attempt
• successful images whose WRITE_end_raw consumes the reservation to its final bytes (delta absorbed by round_page slack)
• CKPT-RESULT rv=-1 errno=22 with no image when the delta exceeds the slack (reservation wall hit mid-note-walk; error swallowed by puthdr)
• (code-certain, not yet observed on-guest) with ≥~7 simultaneous in-window inserts: elf_puttextvp's vnh_max size_t-underflows and cb_put_fp writes vn_hdr records past the kmalloc'd header buffer.

DF-5833 — coredump note-size precompute race → swallowed putallnotes error → size_t-underflowed vnh_max → unbounded cb_put_fp heap overflow

What the bug is (code chain, all verified line-by-line)

1. generic_elf_coredump() sizes the core header with a DRYRUN pass (__elfN(puthdr)(…, DRYRUN, …), imgact_elf.c:1012), allocates target.buf = kmalloc(target.off_max, M_TEMP, M_WAITOK|M_ZERO) (imgact_elf.c:1023) and then re-runs the header generation in WRITE mode (imgact_elf.c:1025 → :1293).
2. elf_putallnotes() sizes its NT_PRSTATUS/NT_FPREGSET notes from the live LWP set (FOREACH_LWP_IN_PROC, imgact_elf.c:1480). The two passes run at different times; in WRITE mode the pass starts with a fresh kmalloc(sizeof(*tmpdata), M_TEMP, M_ZERO|M_WAITOK) (imgact_elf.c:1422). sigexit() holds p->p_token across the dump (kern_sig.c:2385-2423), but DragonFly LWKT tokens are released whenever the holding thread blocks (lwkt_switch → lwkt_relalltokens, lwkt_thread.c:641-643) — so every blocking point between the two walks (the off_max kmalloc, the tmpdata kmalloc, any fp_write) opens a window in which a sibling LWP can mutate the LWP tree. proc_stop(SCORE)'s pre-counted "stopped" LSSLEEP LWPs (kern_sig.c:1598-1612) are exactly such siblings: they are mid-syscall and continue running when woken.
3. If LWPs are inserted between the passes (lwp_create → lwp_rb_tree_RB_INSERT, kern_fork.c:848), the WRITE pass needs 800 bytes/LWP more than reserved. target_reserve() returns NULL, sets *error = EINVAL, but still advances target->off (imgact_elf.c:1268-1274), pushing off past off_max.
4. __elfN(puthdr) discards elf_putallnotes()'s return value (imgact_elf.c:1321-1322) and keeps going.
5. elf_puttextvp() then computes fpc.vnh_max = fpc.vnh + (target->off_max - target->off)/sizeof(vn_hdr) (imgact_elf.c:1653-1655). With off > off_max the subtraction size_t-underflows, making vnh_max astronomically large, and each_segment(p, cb_put_fp, &fpc, 0) writes one 120-byte vn_hdr per vnode-backed mapping starting past the end of the kmalloc'd header buffer (imgact_elf.c:1113-1185). The write length is attacker-chosen (number of mmap'd-file segments), the record contents are attacker-influenced (p_vaddr/p_filesz are the mmap addresses/sizes; the file handle comes from VFS_VPTOFH of attacker-created files).
6. Bonus bug on the same path: error = each_segment(...) at imgact_elf.c:1656 overwrites the reserve-failure EINVAL, so elf_puttextvp returns success even after the overrun.

What was reproduced on the guest (uid 1001, unprivileged)

Rig: eater (pins VM free pages below the allocation floor), victim (200 sleeper threads + 16 worker threads looping lwp_create(2) so their calls park mid-creation on M_WAITOK allocations under the floor), dripper (pre-forked; frees memory in controlled bursts into the parked allocators), controller.sh (orchestrates probe/tune/attempt loops). Trigger: SIGSEGV path (initially) and sys_checkpoint(CKPT_FREEZE) (kern.ckptgroup set to -1 by root for rig determinism — the unprivileged sigexit path drives the identical generic_elf_coredump code).

Reproduced, 20+ times across runs (run.final.log): - The LWP set grows during the dump. Worker threads pre-counted as "stopped" by proc_stop(SCORE) keep completing lwp_create calls and inserting LWPs throughout the dump: children counts grow from the pre-dump snapshot → DRYRUN → WRITE → post-dump by 14-29 per attempt (e.g. attempt 1: snapshot 3586, post-dump 3639, WRITE notes 3822 vs 3803 expected pre-dump LWPs). - The two sizing passes see different LWP sets. A fully-parsed "successful" image (parse2 output) shows WRITE_end_raw consuming the DRYRUN reservation down to its final 112 bytes — i.e. a DRYRUN→WRITE delta of 1-6 notes absorbed by the round_page slack; deltas beyond the slack were observed as: - CKPT-RESULT rv=-1 errno=22 (EINVAL), no image (ckpt2 v2 attempt 4, call-time 93 children / 3 in-flight workers): the WRITE pass hit the reservation wall mid-walk — the size-precompute mismatch materialized as the swallowed-error failure. - The endgame heap-overflow write itself (delta ≥ ~7 simultaneous in-window inserts) did not demonstrably fire in the rig's attempts: the header-allocation page starvation during the DRYRUN→WRITE window and the p_token endgame race bias the dumper on this configuration. The chain up to and including the precondition (mid-dump LWP insertion + reservation overrun) is reproduced; the unbounded write is established by line-level analysis (imgact_elf.c:1653-1655 arithmetic is unconditional).

PoC files

• eater.c, victim.c, dripper.c, controller.sh, parse_core.c, parse2.c — the full rig (build: cc -O2 -o X X.c [-lpthread])
• run.final.log — the final 6-attempt run + image parse analysis
• fix.diff — error propagation + underflow guard

Fix validation

Not performed (kernel rebuild): the heap-overflow write did not demonstrate on-guest within the rig, so there is no observable regression to A/B. The fix.diff removes both enabling defects (swallowed error; underflow-prone bound) by construction.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.