DF-0320 PoC — WiFi A-MSDU reorder buffer race

Status: REAL (source-trace confirmed), not testable on this guest

The race is confirmed by tracing three concurrent mutators of rxa_m[] with no dedicated lock: - RX reorder write at ieee80211_ht.c:911 - Node-age flush at :1151 - ADDBA memset at :553

Not testable because: - No WiFi hardware on this guest - wlan module not loaded at runtime - Requires a remote WiFi peer interleaving A-MPDU + ADDBA frames

The code IS compiled into GENERIC (device wlan).

Fix

See fix.diff — adds struct spinlock rxa_lock to struct ieee80211_rx_ampdu and wraps the critical sections. Verified to compile cleanly on GENERIC.

DF-0320 — Reorder buffer rxa_m[] mutated without dedicated lock

Verdict: REAL (source-trace confirmed) — not testable on this guest (no WiFi HW)

Mechanism

struct ieee80211_rx_ampdu (sys/netproto/802_11/ieee80211_ht.h:151-163) contains struct mbuf *rxa_m[IEEE80211_AGGR_BAWMAX] (64-slot reorder buffer) which is mutated by three concurrent execution contexts with no dedicated lock:

1. RX reorder path — ieee80211_ampdu_reorder() at ieee80211_ht.c:780 writes rxa_m[off] at :911 and calls ampdu_rx_flush() at :897 which frees mbufs from rxa_m[].

2. Node-age callout — ieee80211_ht_node_age() at :1125 iterates TIDs and calls ampdu_rx_flush() at :1151 which frees mbufs from rxa_m[]. Runs from a callout/softclock context.

3. ADDBA re-init — ampdu_rx_start() at :540 calls ampdu_rx_purge() then memset(rap, 0, sizeof(*rap)) at :553, wiping all rxa_m[] entries without freeing them first (or racing with a concurrent flush that's freeing them).

The code is littered with XXX locking comments (:570, :885, :1144). Without serialization: - Context 3 (memset) can zero rxa_m[i] while Context 1/2 is freeing the mbuf → double-free (both the memset-wiped slot and the caller's mbuf reference become dangling) - Context 2 (flush) can free rxa_m[i] while Context 1 is writing to it → use-after-free / type confusion

Privilege / testability

• Remote-triggerable: a WiFi peer interleaving A-MPDU data frames with ADDBA request frames can race the RX reorder path against the ADDBA re-init.
• The wlan code IS compiled into GENERIC (device wlan).
• But requires WiFi hardware — none on this guest.
• The wlan module is not loaded at runtime.

This is a valid hard blocker: the code path is unreachable at runtime on this guest (no WiFi hardware).

Fix

fix.diff — adds a struct spinlock rxa_lock to struct ieee80211_rx_ampdu (using available rxa_pad space), initializes it in ampdu_rx_start(), and wraps the critical ampdu_rx_purge()/ampdu_rx_flush() calls in all three contexts. Also adds #include <sys/spinlock2.h> to ieee80211_ht.c. Verified to compile cleanly on GENERIC.

Impact

Remote double-free / UAF of kernel mbufs from an unauthenticated WiFi peer. On a default kernel with INVARIANTS, this would likely manifest as a panic (slab poisoning detected). Without INVARIANTS, it's a heap corruption primitive exploitable for code execution. Realistic only in a WiFi deployment with HT (802.11n) A-MPDU aggregation.