⬢ DragonFlyBSD Kernel Audit
DF-3428 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3428",
  "status": "build_failed",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "generic_netmap_rxsync trusts the mmapd userspace-writable ring->reserved: the sanitization at netmap_generic.c:694 sums resvd + ring->avail in 32 bits, so resvd=0xFFFFFFFF with avail=1 wraps to 0 and passes; the subsequent k = (k >= resvd) ? ... : k + lim + 1 - resvd (:698) underflows k into [lim+2, 2*lim+2], and the userspace-release loop for (n = 0; j != k; n++) (:702) can never satisfy j == k because j only cycles [0..lim] -> unbounded kernel loop with the kring lock held (NIOCRXSYNC/poll path, netmap.c:1474/1768): unkillable local DoS. Slot writes stay in-bounds (livelock, not corruption). Runtime verification impossible: netmap KLD unbuildable on this tree (netmap_build.log); arithmetic verified manually and contrasted with the non-looping host-ring variant (netmap.c:886-930).",
  "exploit_chain": "would-be: open /dev/netmap (0660 root:wheel) -> NIOCREGIF generic adapter -> mmap ring -> set cur=0, reserved=0xFFFFFFFF, avail=1 -> NIOCRXSYNC -> ioctl never returns, thread unkillable, ring wedged. Repeat per ring/CPU.",
  "evidence": "VERDICT.md (arithmetic trace); trigger_reserved_livelock.c; netmap_build.log; fix.diff",
  "kernel_refs": [
    "sys/net/netmap/netmap_generic.c:641",
    "sys/net/netmap/netmap_generic.c:643",
    "sys/net/netmap/netmap_generic.c:694",
    "sys/net/netmap/netmap_generic.c:698",
    "sys/net/netmap/netmap_generic.c:702",
    "sys/net/netmap/netmap.c:1474",
    "sys/net/netmap/netmap.c:1768",
    "sys/net/netmap/netmap.h:221"
  ],
  "poc_changes": "No seed; authored. Build attempt only (module unbuildable).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 1,
  "build_cmd": "cd /usr/src/sys/net/netmap && make   # fails (shared log)",
  "run_cmd": "n/a - module does not exist on this tree",
  "code_hash": "2b8ce62e1b9da7317d77389d80dc51e1cbbfcab525d59d92a09490ed538eabc7",
  "notes": "Pass-2 netmap finding #3, distinct from DF-0616 (RX overflow) / DF-3426 (TX pool lifetime) / DF-3427 (destructor ABI).",
  "recommended_fix": "Reject ring->reserved > lim outright before the release loop (resvd can never legitimately exceed the slot count); see fix.diff.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds a hard bound (resvd > lim -> reset); not validatable - module unbuildable.",
  "fix_evidence": "fix.diff; netmap_build.log"
}