DF-0368
lagg_clone_create error path calls if_free on embedded ifnet: latent double-free if protocol attach ever fails
Summary
lagg_clone_create(:304-347): ifp=sc->sc_ifp=&sc->sc_if is EMBEDDED in lagg_softc. Destroy path correctly comments "dont free it!" and skips if_free(:435-436). But create error path(:343-346) calls if_free(ifp) THEN kfree(sc) -> double-free of embedded ifnet resources + slab corruption. Currently unreachable: only proto (FAILOVER) ti_attach always returns 0. Latent landmine for any future failing ti_attach.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0368 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 388 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/lagg/if_lagg.c:304: error path calls if_free on embedded ifnet (latent double-free)
Verified recommended fix
Source-confirmed at sys/net/lagg/if_lagg.c:304: error path calls if_free on embedded ifnet (latent double-free)
Verdict
Source-confirmed at sys/net/lagg/if_lagg.c:304: error path calls if_free on embedded ifnet (latent double-free)
No comments yet.