/* * DF-0754 — Deterministic proof of the TWO manifestations of the * mpls_output() by-value bug, as seen by the mpls_output_process() and * ip_output() callers (manifestations 1 & 2 of the finding). * * (DF-0753 already covered manifestation 3 — the mpls_forward() caller in * mpls_input.c. This harness covers the OTHER two callers, which are the * ones cited in the DF-0754 finding.) * * This harness transcribes the EXACT control flow of: * - ip_output() MPLS dispatch sys/netinet/ip_output.c:694-700, 738-744 * - mpls_output_process() sys/netproto/mpls/mpls_output.c:134-150 * - mpls_output() sys/netproto/mpls/mpls_output.c:49-129 * - mpls_push() sys/netproto/mpls/mpls_output.c:152-169 * - mpls_swap() sys/netproto/mpls/mpls_output.c:171-194 * - mpls_pop() sys/netproto/mpls/mpls_output.c:196-212 * - m_prepend() sys/kern/uipc_mbuf.c:1500-1520 * - m_pullup() sys/kern/uipc_mbuf.c:2103-2158 * - M_PREPEND / M_MOVE_PKTHDR sys/sys/mbuf.h * * with faithful userspace stand-ins for struct mbuf / m_freem / m_gethdr. * * The bug: mpls_output() takes `struct mbuf *m` BY VALUE (mpls_output.c:50). * When mpls_push/mpls_swap/mpls_pop reallocate the head mbuf (via M_PREPEND * or m_pullup), only the LOCAL copy of m inside mpls_output is rebound. * mpls_output_process() (which called mpls_output(m,...) by value at :143) * and ip_output() (which called mpls_output_process(m,...) by value at :695) * NEVER see the new head. Two consequences: * * MANIFESTATION 1 (double-free / leak, mpls_output.c:143-146): * If mpls_output() returns an error after a realloc, mpls_output_process() * does m_freem(m) on the stale pointer. Two sub-cases: * M1a: m_prepend OOM -> m already freed inside mpls_push -> DOUBLE-FREE * M1b: m_pullup OOM -> m already freed inside mpls_swap -> DOUBLE-FREE * M1c: PUSH ok then later op fails -> stale head freed, NEW head LEAKED * * MANIFESTATION 2 (stale-mbuf-to-driver, ip_output.c:698 / :742): * On the SUCCESS path, mpls_output_process() returns TRUE and ip_output() * hands the stale `m` to ifp->if_output(). Two sub-cases: * M2a: PUSH realloc succeeded -> m is the OLD (demoted) head, missing * the freshly-pushed MPLS label; the NEW head is LEAKED. Driver * transmits garbage / wrong packet. * M2b: SWAP/POP m_pullup realloc succeeded -> m points to FREED memory * -> UAF when if_output dereferences it. * * The harness uses a POISONED ALLOCATOR (freed memory marked 0xdeadc0de, * matching DragonFly's INVARIANTS WEIRD_ADDR) and detects double-free / UAF. * An injection knob (fail_after) forces m_prepend/m_pullup OOM deterministically * to drive M1a/M1b. * * Build: cc -O2 -Wall -o harness harness.c * Run: ./harness */ #include #include #include #include #include /* Userspace stand-ins for kernel-only defines used by the transcribed code. */ #define ENOBUFS 105 /* mpls_output.c return values */ #define ETIMEDOUT 110 #define ENOTSUP 91 typedef unsigned char boolean_t; #ifndef TRUE #define TRUE 1 #endif #ifndef FALSE #define FALSE 0 #endif /* ------------------------------------------------------------------ */ /* Minimal mbuf model (faithful to the fields the bug touches) */ /* Identical to the proven DF-0753 harness. */ /* ------------------------------------------------------------------ */ #define MHLEN 84 #define MLEN 100 #define M_PKTHDR 0x02 #define M_EXT 0x04 #define M_MPLSLABELED 0x4000 #define ETHER_HDR_LEN 14 #define MPLS_SHIM_LEN 4 struct mbuf { uint32_t magic; uint32_t state; /* 0=free(poisoned), 1=live */ struct mbuf *m_next; int m_flags; int m_len; char *m_data; int pkthdr_len; char m_pktdat[MLEN]; int refcnt; int label; /* tagged by tests to identify which mbuf */ }; #define LIVE_MAGIC 0x4d42464d /* "MBFM" */ #define DEAD_MAGIC 0xdeadc0de static int alloc_count = 0; static int free_count = 0; static int double_free_detected = 0; static int uaf_detected = 0; static int live_allocs = 0; /* outstanding (not freed) mbufs = leak meter */ /* OOM injection: when > 0, the next fail_after successful mbuf_alloc()s * in m_prepend/m_pullup return NULL (simulating M_NOWAIT exhaustion). */ static int fail_after = -1; /* -1 = never fail */ static int alloc_budget = 0; /* counts down inside prepend/pullup paths */ static struct mbuf *mbuf_alloc(int flags) { struct mbuf *m = calloc(1, sizeof(struct mbuf)); assert(m); m->magic = LIVE_MAGIC; m->state = 1; m->m_flags = flags; m->m_data = m->m_pktdat; m->m_next = NULL; m->refcnt = 1; alloc_count++; live_allocs++; return m; } static struct mbuf *m_gethdr(int how, int type) { (void)how; (void)type; return mbuf_alloc(M_PKTHDR); } static struct mbuf *check_live(struct mbuf *m, const char *where) { if (m == NULL) return NULL; if (m->state == 0 || m->magic == DEAD_MAGIC) { printf(" [UAF] deref of freed mbuf %p (label=%d) at %s (magic=0x%x)\n", (void*)m, m->label, where, m->magic); uaf_detected++; return NULL; } return m; } static void m_free_one(struct mbuf *m) { if (m == NULL) return; if (m->state == 0 || m->magic == DEAD_MAGIC) { printf(" [DOUBLE-FREE] m_freem on already-freed mbuf %p (label=%d) " "(magic=0x%x)\n", (void*)m, m->label, m->magic); double_free_detected++; return; } m->state = 0; m->magic = DEAD_MAGIC; free_count++; live_allocs--; } static void m_freem(struct mbuf *m) { while (m) { struct mbuf *next = m->m_next; m_free_one(m); m = next; } } /* ------------------------------------------------------------------ */ /* Faithful transcription of M_MOVE_PKTHDR (uipc_mbuf.c:2551) */ /* NOTE: does NOT clear M_PKTHDR from `from`. */ /* ------------------------------------------------------------------ */ static void M_MOVE_PKTHDR(struct mbuf *to, struct mbuf *from) { assert(to->m_flags & M_PKTHDR); assert(from->m_flags & M_PKTHDR); to->m_flags |= (from->m_flags & (M_PKTHDR|M_MPLSLABELED)); to->pkthdr_len = from->pkthdr_len; } static int M_LEADINGSPACE(struct mbuf *m) { return (int)(m->m_data - m->m_pktdat); } /* ------------------------------------------------------------------ */ /* M_PREPEND (mbuf.h:469) */ /* ------------------------------------------------------------------ */ #define M_PREPEND(mp, plen) do { \ if (M_LEADINGSPACE(*(mp)) >= (plen)) { \ (*(mp))->m_data -= (plen); \ (*(mp))->m_len += (plen); \ (*(mp))->pkthdr_len += (plen); \ } else { \ *(mp) = m_prepend_harness(*(mp), (plen)); \ if (*(mp)) (*(mp))->pkthdr_len += (plen); \ } \ } while(0) /* m_prepend (uipc_mbuf.c:1500) — allocates new head, chains old. * BUG-CRITICAL OOM path: if alloc fails, m_freem(m) and return NULL. */ static struct mbuf *m_prepend_harness(struct mbuf *m, int len) { struct mbuf *mn; if (fail_after >= 0 && alloc_budget >= fail_after) { printf(" [inject] m_prepend: alloc OOM -> m_freem(m=%p label=%d) + return NULL\n", (void*)m, m->label); m_freem(m); /* *** OLD m is FREED here (uipc_mbuf.c:1510) *** */ return NULL; } alloc_budget++; if (m->m_flags & M_PKTHDR) mn = m_gethdr(0, 0); else mn = mbuf_alloc(0); if (mn == NULL) { m_freem(m); return NULL; } if (m->m_flags & M_PKTHDR) M_MOVE_PKTHDR(mn, m); mn->m_next = m; /* OLD m is chained, NOT freed */ mn->m_len = len; mn->m_data = mn->m_pktdat; return mn; /* returns NEW head */ } /* ------------------------------------------------------------------ */ /* m_pullup (uipc_mbuf.c:2103) — slow path frees consumed source mbufs. * BUG-CRITICAL OOM path: if alloc fails, m_freem(n) and return NULL. */ /* ------------------------------------------------------------------ */ static struct mbuf *m_pullup_harness(struct mbuf *n, int len) { if (n->m_len >= len) return n; if (fail_after >= 0 && alloc_budget >= fail_after) { printf(" [inject] m_pullup: alloc OOM -> m_freem(n=%p label=%d) + return NULL\n", (void*)n, n->label); m_freem(n); /* *** OLD n is FREED here *** */ return NULL; } alloc_budget++; { struct mbuf *m; if (n->m_flags & M_PKTHDR) m = m_gethdr(0, 0); else m = mbuf_alloc(0); if (m == NULL) { m_freem(n); return NULL; } m->m_len = 0; if (n->m_flags & M_PKTHDR) M_MOVE_PKTHDR(m, n); { int want = len; struct mbuf *src = n; while (want > 0 && src) { struct mbuf *next = src->m_next; int cnt = src->m_len < want ? src->m_len : want; memcpy(m->m_pktdat + m->m_len, src->m_data, cnt); m->m_len += cnt; want -= cnt; m_free_one(src); /* consumed source mbuf FREED */ src = next; } } m->m_data = m->m_pktdat; m->m_next = NULL; return m; /* NEW head, old n is FREED */ } } /* ------------------------------------------------------------------ */ /* MPLS label encode/decode (faithful to sys/netproto/mpls/mpls.h) */ /* ------------------------------------------------------------------ */ struct mpls { uint32_t mpls_shim; }; #define MPLS_LABEL(s) ((s >> 12) & 0xfffff) #define MPLS_STACK(s) ((s >> 8) & 1) #define MPLS_TTL(s) (s & 0xff) #define MPLS_SET_LABEL(b,l) (b |= ((l & 0xfffff) << 12)) #define MPLS_SET_STACK(b,s) (b |= ((s & 1) << 8)) #define MPLS_SET_TTL(b,t) (b |= (t & 0xff)) struct sockaddr_mpls { int smpls_op; uint32_t smpls_label; }; #define MPLSLOP_PUSH 1 #define MPLSLOP_SWAP 2 #define MPLSLOP_POP 3 struct rtentry { struct sockaddr_mpls shim[3]; int nshim; int from_mpls; int rt_flags; }; #define RTF_MPLSOPS 0x100 #define AF_MPLS 35 #define AF_INET 2 static int label_counter = 100; /* ------------------------------------------------------------------ */ /* THE BUGGY FUNCTIONS — transcribed verbatim from the kernel. */ /* *** mpls_output / mpls_swap / mpls_pop take m BY VALUE *** */ /* ------------------------------------------------------------------ */ /* mpls_push (mpls_output.c:152) — takes struct mbuf** so it DOES update * mpls_output's local m. The bug is one level up. */ static int mpls_push(struct mbuf **m, uint32_t label, int s, int ttl) { uint32_t buf = 0; M_PREPEND(m, MPLS_SHIM_LEN); if (*m == NULL) return (ENOBUFS); /* mpls_output.c:158-159 */ MPLS_SET_LABEL(buf, label); MPLS_SET_STACK(buf, s); MPLS_SET_TTL(buf, ttl); { struct mpls *p = (struct mpls*)(*m)->m_data; p->mpls_shim = buf; } (*m)->m_flags |= M_MPLSLABELED; (*m)->label = ++label_counter; printf(" mpls_push: new head m=%p label=%d\n", (void*)(*m), (*m)->label); return 0; } /* mpls_swap (mpls_output.c:171) — takes m BY VALUE. */ static int mpls_swap(struct mbuf *m, uint32_t label) { if (m->m_len < MPLS_SHIM_LEN) { m = m_pullup_harness(m, MPLS_SHIM_LEN); /* local rebind ONLY */ if (m == NULL) return (ENOBUFS); } { struct mpls *p = (struct mpls*)m->m_data; uint32_t buf = p->mpls_shim; int ttl = MPLS_TTL(buf); if (--ttl <= 0) return (ETIMEDOUT); buf = 0; MPLS_SET_LABEL(buf, label); MPLS_SET_TTL(buf, ttl); p->mpls_shim = buf; } return 0; } /* mpls_pop (mpls_output.c:196) — takes m BY VALUE. */ static int mpls_pop(struct mbuf *m, int *sbit) { if (m->m_len < MPLS_SHIM_LEN) { m = m_pullup_harness(m, MPLS_SHIM_LEN); /* local rebind ONLY */ if (m == NULL) return (ENOBUFS); } { struct mpls *p = (struct mpls*)m->m_data; uint32_t buf = p->mpls_shim; *sbit = MPLS_STACK(buf); } m->m_data += MPLS_SHIM_LEN; m->m_len -= MPLS_SHIM_LEN; return 0; } /* mpls_output (mpls_output.c:49) — takes m BY VALUE. HEART OF THE BUG. */ static int mpls_output(struct mbuf *m, struct rtentry *rt) { int i, error = 0; int stackempty; int ttl = 255; stackempty = rt->from_mpls ? 0 : 1; for (i = 0; i < rt->nshim; i++) { struct sockaddr_mpls *s = &rt->shim[i]; switch (s->smpls_op) { case MPLSLOP_PUSH: error = mpls_push(&m, s->smpls_label, (stackempty && i == 0) ? 1 : 0, ttl); if (error) return (error); /* :88 — local m lost */ stackempty = 0; m->m_flags |= M_MPLSLABELED; break; case MPLSLOP_SWAP: if (stackempty) return (ENOTSUP); error = mpls_swap(m, s->smpls_label); /* m by value! */ if (error) return (error); /* :102 */ break; case MPLSLOP_POP: if (stackempty) return (ENOTSUP); { int sb; error = mpls_pop(m, &sb); } /* m by value! */ if (error) return (error); /* :114 */ break; default: return (ENOTSUP); } } return (error); /* *** caller's m is UNCHANGED — stale *** */ } /* ------------------------------------------------------------------ */ /* mpls_output_process (mpls_output.c:134) — BY VALUE caller. */ /* MANIFESTATION 1 lives here: error-path m_freem(m) at :145. */ /* ------------------------------------------------------------------ */ static boolean_t mpls_output_process(struct mbuf *m, struct rtentry *rt) { int error; if (!(rt->rt_flags & RTF_MPLSOPS)) /* :140 */ return TRUE; error = mpls_output(m, rt); /* :143 — m by VALUE */ if (error) { printf(" mpls_output_process: error=%d -> m_freem(stale m=%p label=%d)\n", error, (void*)m, m ? m->label : -1); m_freem(m); /* :145 — DOUBLE-FREE / UAF */ return FALSE; } return TRUE; /* success: caller uses stale m */ } /* ------------------------------------------------------------------ */ /* ip_output MPLS dispatch (ip_output.c:694-700) — the upstream caller. * MANIFESTATION 2 lives here: success-path ifp->if_output(stale m) at :698. */ /* ------------------------------------------------------------------ */ static int if_output_deref_count = 0; static int if_output_received_label = -1; static int fake_if_output(struct mbuf *m) { if_output_deref_count++; printf(" if_output: received m=%p label=%d\n", (void*)m, m ? m->label : -1); /* The driver dereferences m (reads m_len, m_data, m_flags, pkthdr.len). * If m is freed memory -> UAF. If m is a demoted head -> wrong packet. */ if (check_live(m, "if_output(m) deref")) { if_output_received_label = m->label; printf(" if_output: m LIVE, m_len=%d pkthdr.len=%d M_PKTHDR=%d " "M_MPLSLABELED=%d\n", m->m_len, m->pkthdr_len, (m->m_flags & M_PKTHDR)?1:0, (m->m_flags & M_MPLSLABELED)?1:0); /* faithfully: if_output/ifq_dispatch consumes (frees) the mbuf */ m_freem(m); } return 0; } /* Simulate ip_output()'s MPLS dispatch + if_output call (ip_output.c:694-700). */ static void ip_output_mpls_dispatch(struct mbuf *m, struct rtentry *rt) { boolean_t cont; printf(" ip_output: m=%p label=%d (head)\n", (void*)m, m->label); cont = mpls_output_process(m, rt); /* ip_output.c:695 — by value */ if (!cont) { printf(" ip_output: mpls_output_process=FALSE -> goto done (m already freed at :145)\n"); return; /* goto done */ } printf(" ip_output: mpls_output_process=TRUE -> ifp->if_output(stale m=%p)\n", (void*)m); (void)fake_if_output(m); /* ip_output.c:698 — STALE m */ } /* ------------------------------------------------------------------ */ /* Test helpers */ /* ------------------------------------------------------------------ */ static struct mbuf *make_ip_pkt(int leading_space) { struct mbuf *m = m_gethdr(0, 0); m->m_data = m->m_pktdat + leading_space; memset(m->m_pktdat, 0xAA, sizeof(m->m_pktdat)); /* dummy IP header (first 4 bytes = version/IHL + ttl byte at offset 8) */ m->m_data[0] = 0x45; m->m_data[8] = 64; /* ip_ttl = 64 */ m->m_len = 20; m->pkthdr_len = 20; m->label = ++label_counter; return m; } static struct mbuf *make_mpls_frag_chain(void) { /* fragmented MPLS chain: first mbuf m_len=2 (< 4) -> triggers m_pullup. * Write a valid MPLS shim (TTL=64 in the low byte) across the split so * that after m_pullup reassembles it, mpls_swap sees a live TTL and * SUCCEEDS (returns 0) — exercising the success-path stale-mbuf-to-driver * (manifestation 2b) rather than the error path. */ struct mbuf *m = m_gethdr(0, 0); struct mbuf *m2 = mbuf_alloc(0); uint32_t shim = 0; MPLS_SET_LABEL(shim, 100); MPLS_SET_STACK(shim, 1); MPLS_SET_TTL(shim, 64); /* TTL=64 so SWAP succeeds (--ttl=63) */ m->m_flags |= M_MPLSLABELED; m->m_len = 2; /* scatter the 4-byte shim: first 2 bytes in m, next 2 in m2 */ memcpy(m->m_data, &shim, 2); memcpy(m2->m_pktdat, ((char*)&shim) + 2, 2); m2->m_len = 32; memset(m2->m_pktdat + 2, 0xBB, 30); m2->m_data = m2->m_pktdat; m2->label = ++label_counter; m->m_next = m2; m->pkthdr_len = 34; m->label = ++label_counter; return m; } static void reset_accounting(void) { alloc_count = free_count = 0; double_free_detected = uaf_detected = 0; live_allocs = 0; if_output_deref_count = 0; if_output_received_label = -1; fail_after = -1; alloc_budget = 0; } static void report(const char *label, const char *expect) { printf("\n --- %s ---\n", label); printf(" allocs=%d frees=%d outstanding(live)=%d double_free=%d uaf=%d\n", alloc_count, free_count, live_allocs, double_free_detected, uaf_detected); printf(" if_output derefs=%d last_received_label=%d\n", if_output_deref_count, if_output_received_label); printf(" EXPECT: %s\n", expect); if (double_free_detected) printf(" *** MANIFESTATION 1 (DOUBLE-FREE) CONFIRMED ***\n"); if (uaf_detected) printf(" *** UAF CONFIRMED ***\n"); if (live_allocs > 0 && !double_free_detected) printf(" *** MBUF LEAK: %d outstanding alloc(s) not freed ***\n", live_allocs); } /* ================================================================== */ /* MAIN — run all manifestation scenarios */ /* ================================================================== */ int main(void) { struct rtentry rt_push, rt_swap, rt_push_then_swap; printf("================================================================\n"); printf("DF-0754 harness — mpls_output() by-value bug\n"); printf("Focus: mpls_output_process() [M1] + ip_output() [M2] callers\n"); printf("(DF-0753 already covered the mpls_forward()/mpls_input.c caller)\n"); printf("================================================================\n\n"); /* ---- MANIFESTATION 1a: PUSH + m_prepend OOM -> DOUBLE-FREE ---- * mpls_push -> M_PREPEND -> m_prepend OOM -> m_prepend does * m_freem(m) and returns NULL. mpls_output returns ENOBUFS. * mpls_output_process:145 does m_freem(m) on the SAME (freed) m. */ printf("----------------------------------------------------------------\n"); printf("M1a: PUSH + m_prepend OOM -> mpls_output_process:145 DOUBLE-FREE\n"); printf(" (mpls_output.c:143 by-value, :145 m_freem on already-freed m)\n"); printf("----------------------------------------------------------------\n"); reset_accounting(); memset(&rt_push, 0, sizeof(rt_push)); rt_push.from_mpls = 1; rt_push.rt_flags = RTF_MPLSOPS; rt_push.nshim = 1; rt_push.shim[0].smpls_op = MPLSLOP_PUSH; rt_push.shim[0].smpls_label = 999; { struct mbuf *m = make_ip_pkt(/*leading_space=*/0); /* force m_prepend */ fail_after = 0; /* first m_prepend alloc -> OOM */ ip_output_mpls_dispatch(m, &rt_push); } report("M1a result", "double_free >= 1 (mpls_output_process:145 frees freed m)"); /* ---- MANIFESTATION 1b: SWAP + m_pullup OOM -> DOUBLE-FREE ---- * mpls_swap -> m_pullup OOM -> m_pullup does m_freem(n) and returns NULL. * mpls_swap returns ENOBUFS, mpls_output returns ENOBUFS, * mpls_output_process:145 m_freem(m) on freed m. */ printf("\n----------------------------------------------------------------\n"); printf("M1b: SWAP + m_pullup OOM -> mpls_output_process:145 DOUBLE-FREE\n"); printf(" (mpls_swap takes m by value; m_pullup frees old m on OOM)\n"); printf("----------------------------------------------------------------\n"); reset_accounting(); memset(&rt_swap, 0, sizeof(rt_swap)); rt_swap.from_mpls = 1; rt_swap.rt_flags = RTF_MPLSOPS; rt_swap.nshim = 1; rt_swap.shim[0].smpls_op = MPLSLOP_SWAP; rt_swap.shim[0].smpls_label = 200; { struct mbuf *m = make_mpls_frag_chain(); /* m_len=2 -> m_pullup */ fail_after = 0; /* m_pullup alloc -> OOM */ ip_output_mpls_dispatch(m, &rt_swap); } report("M1b result", "double_free >= 1 (stale m freed by m_pullup, re-freed at :145)"); /* ---- MANIFESTATION 1c: PUSH ok, then later op errors -> LEAK ---- * PUSH reallocs (new head mn, old m chained under it). Then a subsequent * op errors (here: unknown op -> ENOTSUP at mpls_output.c:124, which is * the cleanest "push-then-error" since it does no alloc/free itself). * mpls_output returns error. mpls_output_process:145 m_freem(stale m) * frees only the OLD chain reachable from the stale pointer; the NEW head * mn is NOT reachable from stale m (mn->m_next=m, not m->m_next=mn) and * is therefore LEAKED. This is the "new-head leak (push-then-error)" * variant named in the finding. */ printf("\n----------------------------------------------------------------\n"); printf("M1c: PUSH ok then later op ENOTSUP -> stale head freed, NEW head LEAKED\n"); printf(" (mpls_output_process:145 frees stale m; new pushed head unreachable)\n"); printf("----------------------------------------------------------------\n"); reset_accounting(); memset(&rt_push_then_swap, 0, sizeof(rt_push_then_swap)); rt_push_then_swap.from_mpls = 1; rt_push_then_swap.rt_flags = RTF_MPLSOPS; rt_push_then_swap.nshim = 2; rt_push_then_swap.shim[0].smpls_op = MPLSLOP_PUSH; rt_push_then_swap.shim[0].smpls_label = 999; rt_push_then_swap.shim[1].smpls_op = 99; /* unknown -> default: ENOTSUP */ rt_push_then_swap.shim[1].smpls_label = 200; { struct mbuf *m = make_ip_pkt(/*leading_space=*/0); /* force m_prepend */ fail_after = -1; /* PUSH succeeds, second op errors without alloc */ ip_output_mpls_dispatch(m, &rt_push_then_swap); } report("M1c result", "double_free=0 (old chain freed once), " "live_allocs >= 1 (new pushed head LEAKED)"); /* ---- MANIFESTATION 2a: PUSH realloc, SUCCESS -> stale m to driver ---- * PUSH succeeds (new head mn created, old m chained under it). * mpls_output returns 0, mpls_output_process returns TRUE. * ip_output:698 if_output(stale m) — m is the OLD head, missing the * freshly-pushed MPLS label. The driver transmits the WRONG packet. * New head mn is LEAKED. */ printf("\n----------------------------------------------------------------\n"); printf("M2a: PUSH realloc SUCCESS -> ip_output:698 if_output(STALE m)\n"); printf(" (driver gets demoted old head; new pushed head leaked)\n"); printf("----------------------------------------------------------------\n"); reset_accounting(); { struct mbuf *m = make_ip_pkt(/*leading_space=*/0); /* force m_prepend */ fail_after = -1; ip_output_mpls_dispatch(m, &rt_push); } report("M2a result", "if_output_received_label == original IP mbuf label (STALE), " "live_allocs >= 1 (new head leaked)"); /* ---- MANIFESTATION 2b: SWAP m_pullup realloc, SUCCESS -> UAF ---- * mpls_swap -> m_pullup (m_len<4) -> realloc, frees old m, returns new. * mpls_swap's local m is rebound; mpls_output's & caller's m are NOT. * mpls_output returns 0, mpls_output_process returns TRUE. * ip_output:698 if_output(stale m) — m is FREED memory -> UAF in driver. */ printf("\n----------------------------------------------------------------\n"); printf("M2b: SWAP m_pullup realloc SUCCESS -> ip_output:698 if_output(FREED m)\n"); printf(" (stale m is freed memory; driver deref = UAF)\n"); printf("----------------------------------------------------------------\n"); reset_accounting(); { struct mbuf *m = make_mpls_frag_chain(); /* m_len=2 -> m_pullup realloc */ fail_after = -1; ip_output_mpls_dispatch(m, &rt_swap); } report("M2b result", "uaf >= 1 (driver deref of freed m at if_output)"); /* ---- CONTROL: PUSH with adequate leading space -> NO bug ---- * 14 bytes headroom >= 4 -> M_PREPEND fast path (m_data -= 4), no realloc. * Caller's m stays valid. Proves the bug is realloc-dependent. */ printf("\n----------------------------------------------------------------\n"); printf("CONTROL: PUSH with leading_space=14 -> fast path, NO realloc, NO bug\n"); printf("----------------------------------------------------------------\n"); reset_accounting(); { struct mbuf *m = make_ip_pkt(/*leading_space=*/ETHER_HDR_LEN); fail_after = -1; ip_output_mpls_dispatch(m, &rt_push); } report("CONTROL result", "double_free=0, uaf=0, live_allocs=0 (clean)"); printf("\n================================================================\n"); printf("DF-0754 harness complete.\n"); printf("Root cause: mpls_output() takes `struct mbuf *m` BY VALUE\n"); printf(" (mpls_output.c:50). Callers mpls_output_process() (:143) and\n"); printf(" ip_output() (:695) never see the new head after a realloc.\n"); printf(" M1: error path m_freem(stale) at :145 = DOUBLE-FREE / leak.\n"); printf(" M2: success path if_output(stale) at ip_output.c:698 = stale/UAF.\n"); printf("Fix: mpls_output(struct mbuf **mp) propagates head through *mp\n"); printf(" (same fix as DF-0753 — closes BOTH findings).\n"); return 0; }