DF-0605 — PoC: pfi_get_ifaces UAF walk (shell driver)

Privileged local UAF PoC. pfi_get_ifaces() walks the global pfi_ifs RB tree with only crit_enter() (CPU-local), while concurrent ifnet_detach_event on another CPU frees kifs via pfi_kif_unref. The walker's nextp may land on a freed kif → UAF read in pfi_skip_if.

Files

• race.sh — shell driver (tight pfctl -i all -v loop + concurrent ifconfig vlan* create/destroy loop).
• (added by per-PoC verifier) full C harness with cpuset -x pinning, build.sh, run.sh, run.log, VERDICT.md, manifest.json, fix.diff.

Run

On a 2+ CPU DragonFly system with pf enabled:

# CPU 0: tight DIOCIGETIFACES loop
while :; do pfctl -i all -v 2>/dev/null; done &

# CPU 1: create+destroy many interfaces concurrently
while :; do
    for i in $(seq 0 64); do ifconfig vlan$i create 2>/dev/null; done
    for i in $(seq 0 64); do ifconfig vlan$i destroy 2>/dev/null; done
done &

Expected outcome

Kernel panic with a stack trace through pfi_skip_if / strcmp / TAILQ_FOREACH inside pfi_get_ifaces:

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x...
backtrace:
    pfi_skip_if+0x...
    pfi_get_ifaces+0x...
    pfioctl+0x...

Notes for the per-PoC verifier

• Use cpuset -x / usched_setcpu to pin the two loops to different CPUs for reliable race overlap.
• The walker visits each kif in the tree; on a system with many interfaces / groups, the per-call success probability scales linearly with the number of kifs.
• Heap grooming of the freed kif (sizeof(struct pfi_kif)) for code- execution escalation requires a slab-size analysis; document the victim object in VERDICT.md.
• Verify the fix with git apply findings/poc/DF-0605/fix.diff (the lwkt_gettoken(&pf_token) around the walk + tree-mutating event handlers); after the fix the race should no longer fire.

DF-0605 — VERDICT

Verdict: REPRODUCED (code-level; live trigger rare). The bug is real per line-by-line code analysis of the cited paths. Live panic manifestation is statistically rare (the UAF read usually returns stale-but-valid RB tree pointers, masking the corruption), but the synchronization hole is unambiguous in the source.

Severity: Medium (root-only trigger, no privilege boundary to cross)

Mechanism (confirmed by code review, path:line citations)

pfi_get_ifaces() at sys/net/pf/pf_if.c:764-790 walks the global pfi_ifs RB tree with only CPU-local crit_enter() (line 769). crit_enter() prevents preemption on the local CPU but does NOT serialize against other CPUs. The walker captures nextp via RB_NEXT(pfi_ifhead, &pfi_ifs, p) at line 771 (and again at line 783 after the copyout) and uses p = nextp on the next loop iteration without any guarantee that nextp is still allocated or still in the tree.

Although pfi_get_ifaces's only caller, pfioctl() at sys/net/pf/pf_ioctl.c:981-989, does take lwkt_gettoken(&pf_token) for the entire ioctl duration, the mutator side does NOT. The ifnet_detach_event handler chain:

if_detach() (sys/net/if.c:949) → EVENTHANDLER_INVOKE(ifnet_detach_event, ifp) (sys/net/if.c:958, fired WITHOUT pf_token and WITHOUT ifnet_lock — that lock is only taken later at line 970) → pfi_detach_ifnet_event() (sys/net/pf/pf_if.c:882) → pfi_detach_ifnet() (sys/net/pf/pf_if.c:297) → sets kif->pfik_ifp = NULL (line 307) and calls pfi_kif_unref(kif, PFI_KIF_REF_NONE) (line 309) → pfi_kif_unref() at sys/net/pf/pf_if.c:246-253 does RB_REMOVE(pfi_ifhead, &pfi_ifs, kif); kfree(kif, M_PFI); when pfik_ifp==NULL && pfik_group==NULL && kif != pfi_all && pfik_rules==0 && pfik_states==0.

pfi_detach_ifnet itself uses only crit_enter() (line 304), so it runs concurrently with the walker on another CPU. The walker's nextp, captured before the free, may point at the freed kif; the next loop iteration's pfi_skip_if(name, p) then reads p->pfik_name (line 800) and p->pfik_ifp (line 807) from freed memory, and RB_NEXT(pfi_ifhead, &pfi_ifs, p) at line 771/783 reads stale RB tree pointers from the freed slab chunk.

The same unlocked-walk pattern is present in pfi_set_flags() (pf_if.c:821-833) and pfi_clear_flags() (pf_if.c:836-848), which use RB_FOREACH over pfi_ifs with only crit_enter().

Live reproduction attempts

• Build: cc -O2 -o race race.c (header-free C harness; no dependency on <net/pfvar.h> which is not in /usr/include). Builds cleanly.
• Probe: kernel sizeof(struct pfi_kif) = 224 bytes (matches the pfiio_esize check at pf_ioctl.c:3022).
• Race harness (race.c): spawns N walker processes (each tight- looping DIOCIGETIFACES on /dev/pf, pinned to CPU 0..N-1) and M mutator processes (each tight-looping SIOCIFCREATE/SIOCIFDESTROY on vlanN, pinned to CPU N..N+M-1).
• Result: One observed guest wedge-to-DDB on the first invocation (vm.sh reset reported "guest not answering (likely DDB on panic)" and the QEMU process was killed to recover). The serial boot log did not capture a clean panic signature — most likely because the vlanN: MAC address syslog flooding (2529 lines in 30s) saturated the serial buffer. After muting console logging (sysctl kern.log_console_output=0), subsequent 30s/60s/90s races with 4 walkers + 3 mutators did not panic.

The race is genuinely hard to win because: 1. The walker's window between nextp = RB_NEXT(...) (line 771) and the next iteration's pfi_skip_if(name, p=nextp) is microseconds. 2. Even when the race is won, INVARIANTS only poisons the first 64 bytes of the freed chunk (WEIRD_ADDR = 0xdeadc0de, sizeof(weirdary) = 64 at sys/kern/kern_slaballoc.c:231,313). pfik_ifp lives at offset ~176 — outside the poisoned region, so it retains its NULL value (set by pfi_detach_ifnet at line 307 before the kfree). The walker's if (p->pfik_ifp != NULL) test at line 807 evaluates false, pfi_skip_if returns 1 (skip), and the walk continues silently along stale RB-tree pointers which usually still point to valid tree nodes. 3. A visible panic requires the freed slab chunk to be reused for an object that writes non-NULL data over the RB_ENTRY/pfik_ifp fields before the walker re-reads them — a narrow timing condition.

This is the typical profile of a real-but-hard-to-trigger kernel UAF: the bug is unambiguously present in the source, but the live manifestation is probabilistic and often silent. The race IS the bug.

Why this is Medium (not higher)

• Privilege requirement: pf.ko is not loaded by default (the with-src baseline has no /dev/pf until kldload pf.ko is run as root). /dev/pf is crw------- root:wheel (0600). DIOCIGETIFACES therefore requires root. SIOCIFCREATE/SIOCIFDESTROY are gated by caps_priv_check(cred, SYSCAP_RESTRICTEDROOT) at sys/net/if.c:2007, 2013. Both sides of the race are root-only. There is no unprivileged path to trigger this bug.

• No privilege boundary to cross: root→kernel is game-over by definition (root can kldload arbitrary code). A root-only kernel panic is a robustness/DoS issue, not a privilege escalation.

• Race complexity: the walker's nextp must land on the exact kif being freed on a remote CPU within a microsecond window.

Exploit chain / escalation

none — no escalation chain is meaningful for this finding.

Per the bright-line rule in the runner procedure: an escalation chain must be exercisable by an unprivileged user end-to-end. This finding has no unprivileged path at all (/dev/pf is 0600 root:wheel; PF is a non-default module requiring kldload; both DIOCIGETIFACES and SIOCIFCREATE/SIOCIFDESTROY require root). Root→kernel is game-over by definition. So this is a root→kernel hardening/robustness gap, not an escalation primitive. The realistic impact ceiling is a kernel panic (DoS) caused by an administrator who loads PF and concurrently provisions/tears-down interfaces (e.g. a virtualization host or router with dynamic VLAN/tap/gre churn).

PoC changes

The original findings/poc/DF-0605/README.md suggested a shell driver (pfctl -i all -v loop + ifconfig vlanN create/destroy loop). I implemented it as a header-free C harness (race.c) because:

1. <net/pfvar.h> is not installed in /usr/include (PF is a module), so a PoC that #includes it cannot compile from the standard include path. The harness inlines the necessary struct definitions (struct pfi_kif, struct pfioc_iface) and the DIOCIGETIFACES _IOWR macro verbatim from sys/net/pf/pfvar.h.
2. cpumask_t in DragonFly is struct { u64 ary[4]; } (32 bytes), not a single unsigned long — the lwp_setaffinity (syscall 544) pinning had to use the right mask size.
3. The harness probes the kernel's sizeof(struct pfi_kif) at startup (the pfiio_esize check at pf_ioctl.c:3022 returns ENODEV before pfi_get_ifaces is called if the element size is wrong) — it found 224 bytes, vs the 216-byte C-layout in race.c (8 bytes of compiler-injected tail padding). The probe handles both.
4. The harness forks N walker + M mutator children (default 4 + 3), pins them across CPUs, and arms per-child SIGALRM so they all terminate cleanly on timeout (the original 1-walker/1-mutator version almost never hit the window).
5. race.sh is the original shell driver, kept for reference.

Recommended fix

fix.diff adds lwkt_gettoken(&pf_token) / lwkt_reltoken(&pf_token) around the bodies of:

• pfi_attach_ifnet (pf_if.c:278)
• pfi_detach_ifnet (pf_if.c:296) — the actual free path
• pfi_attach_ifgroup (pf_if.c:313)
• pfi_detach_ifgroup (pf_if.c:327)
• pfi_group_change (pf_if.c:343)
• pfi_get_ifaces (pf_if.c:787) — defense-in-depth; recursive-safe since the only current caller (pfioctl) already holds pf_token, but guards against future callers that forget
• pfi_set_flags (pf_if.c:821) and pfi_clear_flags (pf_if.c:836) — same unlocked-walk pattern

The fix is conservative and minimal: it adds NO new locks, just takes the existing pf_token (already used by the rest of pfioctl and by pf.c packet processing) at the tree-mutation entry points. Once both walker and mutator hold the same token, lwkt_token's exclusive-acquire semantics serialize them across CPUs and the race window disappears.

This matches the finding markdown's ## Recommended fix proposal (which asked for pf_token around the walk and the tree-mutating event handlers), and additionally covers pfi_set_flags/pfi_clear_flags which have the identical unlocked-walk pattern.

Fix validation (Phase 8)

• Baseline (#0 unpatched): applied fix.diff to /usr/src, make -j6 nativekernel KERNCONF=X86_64_GENERIC succeeded (rc=0, no errors; full build log in fix_build.log).
• Patched (#1): copied kernel.stripped → /boot/kernel/kernel, kernel.debug → /boot/kernel/kernel.debug, rebooted. kern.version correctly bumped from 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 to 6.5-DEVELOPMENT #1: Wed Jul 8 19:08:12 UTC 2026.
• Post-fix behavior: pf.ko loads, /dev/pf appears, pfctl -s info works, ifconfig vlanN create/destroy works, and the same race harness (4 walkers + 3 mutators, 90s) ran clean with no panic.
• Caveat: the race is statistically rare on the unpatched kernel too (it requires the walker's microsecond window to overlap a remote-CPU free AND the freed chunk's RB-tree pointers to be corrupted by slab reuse). The fix is therefore validated primarily by code analysis: with pf_token held by both walker and mutator, lwkt_token's exclusive-acquire semantics serialize them across CPUs and the race window is eliminated by construction. A successful compile + boot + clean PoC run confirms the patch does not regress PF functionality.

Files

• race.c — C harness (header-free; N walkers + M mutators across CPUs)
• race.sh — original shell driver, kept for reference
• build.sh / run.sh — exact reproduce commands
• fix.diff — git-apply-able fix (15 hunks, all apply cleanly)
• fix_build.log — full untrimmed single-fix kernel build output (rc=0)
• fix_run.log — patched-kernel PoC run (clean exit, no panic)
• env.txt — guest environment for this run