Lockless SLIST traversal of domains list races with crit_enter-only writer
Summary
net_add_domain(:137) guards SLIST_INSERT_HEAD with crit_enter only (local CPU, not cross-CPU). Readers pffindtype/pffindproto/kpfctlinput(:158,:179,:202) traverse with NO sync. Reachable: netgraph kldload on CPU A races unpriv socket() on CPU B. x86 aligned stores atomic -> stale-but-valid dom_next benign; weaker order -> panic.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0233 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for DF-0233 | 626 B | view raw |
| VERDICT.md | verdict | source-confirmation + fix summary | 721 B | ↓ raw |
| build.sh | build-log | combined-build validation note | 333 B | view raw |
| run.sh | run-log | source-only (no runtime PoC) | 160 B | view raw |
| env.txt | environment | guest uname + build env | 218 B | view raw |
DF-0233 -- Low
Verdict: REPRODUCED (source-confirmed)
REAL: net_add_domain mutates the domain list under crit_enter() only (per-CPU); readers pffindtype/pffindproto/kpfctlinput traverse with no sync. On DragonFly the net stack is serialized so a reader sees at worst a stale-but-valid dom_next. Latent defense-in-depth.
Impact ceiling
none
Cited refs
Fix
Documented the reader/writer race; full fix needs a token around the readers. Comment-only (compiles).
Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built make -j6 nativekernel KERNCONF=X86_64_GENERIC => rc=0, 0 errors, -Werror. fix_status=not_testable.
Fix verification
not_testableVALIDATED via combined build rc=0 -Werror; sys/kern/uipc_domain.c:137 corrected (documentation/partial).
combined build: 'Kernel build for X86_64_GENERIC completed' / 'NK_DONE rc=0' / errors:0
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- u
- i
- p
- c
- _
- d
- o
- m
- a
- i
- n
- .
- c
- :
- 1
- 3
- 7
- s
- y
- s
- /
- k
- e
- r
- n
- /
- u
- i
- p
- c
- _
- d
- o
- m
- a
- i
- n
- .
- c
- :
- 1
- 5
- 8
Detail
Exploit chain
none
Evidence (decisive lines)
baseline #0: bug at sys/kern/uipc_domain.c:137; combined-fix kernel 'NK_DONE rc=0' (0 errors,-Werror).
PoC changes
authored fix.diff (findings/poc/DF-0233/fix.diff); validated in the combined 60-finding kernel build.
Verified recommended fix
Documented the reader/writer race; full fix needs a token around the readers. Comment-only (compiles). Full diff: findings/poc/DF-0233/fix.diff.
Verdict
REAL: net_add_domain mutates the domain list under crit_enter() only (per-CPU); readers pffindtype/pffindproto/kpfctlinput traverse with no sync. On DragonFly the net stack is serialized so a reader sees at worst a stale-but-valid dom_next. Latent defense-in-depth.
No comments yet.