Summary

ngt_rcvdata() enqueues mbufs into sc->outq (via IF_QFULL/IF_DROP/ IF_ENQUEUE and a direct ifq_len read at lines 591-598) WITHOUT holding tp->t_token. Meanwhile ngt_start() dequeues from the same queue (IF_DEQUEUE/IF_PREPEND at lines 421/440) WHILE holding tp->t_token (line 416). These two code paths execute concurrently on SMP: ngt_rcvdata runs on CPU 0 via the netgraph message port, while ngt_start is invoked from device-driver interrupt context on any CPU. The concurrent unsynchronized linked-list manipulation corrupts the ifqueue, and in the worst case produces a use-after-free write into a freed mbuf's m_nextpkt field.

Root cause

The file's own locking comment (lines 154-167) is aspirational fiction. Lines 157-158 claim "node private data and tp->t_lsc is protected by mutex in struct ifqueue" — but struct ifqueue (sys/net/if_var.h:120-126) contains NO mutex: it is just {ifq_head, ifq_tail, ifq_len, ifq_maxlen, ifq_drops}.

ngt_rcvdata (lines 591-607) does NOT acquire tp->t_token before any queue operation:

591:    if (IF_QFULL(&sc->outq)) {       /* no token held */
592:        IF_DROP(&sc->outq);
597:    IF_ENQUEUE(&sc->outq, m);       /* no token held */
598:    qlen = sc->outq.ifq_len;        /* no token held */
...
604:        lwkt_gettoken(&tp->t_token);   /* token acquired HERE — too late */
605:        ngt_start(sc->tp);
606:        lwkt_reltoken(&tp->t_token);

Every other function that touches sc->outq correctly holds tp->t_token: ngt_start (line 416), ngt_shutdown (line 559). ngt_rcvdata is the sole outlier.

The IF_ENQUEUE macro (if_var.h:484-492) performs a non-atomic sequence: m->m_nextpkt=NULL; if (ifq_tail==NULL) ifq_head=m; else ifq_tail->m_nextpkt=m; ifq_tail=m; ifq_len++. IF_DEQUEUE (if_var.h:502-510) is equally non-atomic. Concurrent execution corrupts ifq_head/ifq_tail/ifq_len and the m_nextpkt linkage.

Threat model & preconditions

• Attacker position: any local user with SYSCAP_NONET_NETGRAPH who has set up an ng_tty line discipline on a tty (serial port or pty), OR a remote unauthenticated peer on a PPP-over-ng_tty link whose traffic generates outbound data.
• Requires SMP (the standard DragonFlyBSD configuration).
• Trigger: send data to the ng_tty hook via netgraph (triggering ngt_rcvdata on CPU 0) while the tty device driver drains its output queue and calls l_start→ngt_start on another CPU.
• Impact ranges from:
• kernel panic (corrupted list → NULL/invalid pointer deref on next traversal, or ifq_len underflow causing unbounded queue growth and memory exhaustion),
• to use-after-free write enabling kernel code execution. The UAF write scenario: (1) queue empty; (2) CPU0 ngt_rcvdata IF_ENQUEUE(X): sets ifq_head=X, [preempted before ifq_tail=X]; (3) CPU1 ngt_start IF_DEQUEUE: dequeues X, calls m_free(X); (4) CPU0 resumes: sets ifq_tail=X (freed); (5) next IF_ENQUEUE writes to freed_X->m_nextpkt — a write to freed slab memory that an attacker can groom to overwrite a victim object.

Recommended fix

Acquire tp->t_token in ngt_rcvdata before any sc->outq access, matching the locking already used by ngt_start and ngt_shutdown:

--- a/sys/netgraph7/tty/ng_tty.c
+++ b/sys/netgraph7/tty/ng_tty.c
@@ -588,6 +588,13 @@ ngt_rcvdata(hook_p hook, item_p item)
    NGI_GET_M(item, m);
    NG_FREE_ITEM(item);

+   /*
+    * Hold tp->t_token for all outq operations to serialize
+    * against ngt_start() which dequeues under the same token.
+    */
+   lwkt_gettoken(&tp->t_token);
+
    if (IF_QFULL(&sc->outq)) {
        IF_DROP(&sc->outq);
+       lwkt_reltoken(&tp->t_token);
        NG_FREE_M(m);
        return (ENOBUFS);
    }
@@ -600,11 +607,8 @@ ngt_rcvdata(hook_p hook, item_p item)
    /*
     * If qlen > 1, then we should already have a scheduled callout.
     */
-   if (qlen == 1) {
-       lwkt_gettoken(&tp->t_token);
+   if (qlen == 1)
        ngt_start(sc->tp);
-       lwkt_reltoken(&tp->t_token);
-   }

+   lwkt_reltoken(&tp->t_token);
    return (0);
 }

The stale locking comment at lines 154-167 should also be corrected: struct ifqueue has no mutex; the actual serialization is tp->t_token.

References

• sys/netgraph7/tty/ng_tty.c:591-598 — the unlocked queue operations.
• sys/netgraph7/tty/ng_tty.c:416-421 — ngt_start with the token held.
• sys/net/if_var.h:120-126 — struct ifqueue (no mutex).
• sys/net/if_var.h:484-492 — IF_ENQUEUE (non-atomic).

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).