DF-0726 — if_cloners list / if_cloners_count unlocked race

Summary

The if_cloners list (sys/net/if_clone.c:43) and if_cloners_count (:44) are accessed without holding ifnet_lock in four functions: if_clone_attach (:147,:166-167), if_clone_detach (:192-194), if_clone_list (:207,:216,:219-221), and if_clone_lookup (:300).

The reader (if_clone_list) is reachable from the unprivileged SIOCIFGCLONERS ioctl (sys/net/if.c:2017-2018 — no caps_priv_check). The writers (if_clone_attach/if_clone_detach) are called from module load/unload (root-only kldload/kldunload).

A concurrent reader-vs-writer race can cause the reader to dereference a freed/unmapped ifc pointer (UAF read) after module unload calls vm_map_remove (sys/kern/link_elf_obj.c:904), panicking the kernel.

How to reproduce

./build.sh    # cc -O2 -pthread -o reader2 reader2.c  (and reader)
./run.sh      # starts reader as maxx + kldload/kldunload loop as root

Expected (bug present): kernel panic (fatal trap in if_clone_list or copyout during list traversal, reading unmapped module memory). Expected (fixed): no panic; reader returns correct cloner list; modules load/unload cleanly.

Files

• reader.c — single-threaded SIOCIFGCLONERS hammer (unprivileged reader).
• reader2.c — multi-threaded + madvise(MADV_DONTNEED) copyout-window widener.
• build.sh / run.sh — exact build/run commands.
• VERDICT.md — full analysis, mechanism trace, reproduction attempts, fix validation.
• fix.diff — verified fix (ifnet_lock wrapping all list accesses).
• fix_build.log — full kernel build output (rc=0).
• fix_run.log — patched-kernel functional test results.
• run.log — unpatched-kernel race attempt results (3 attempts, 265M iters, no panic).
• env.txt — guest environment (uname, kern.version, cc, kernel sha256).
• manifest.json — artifact catalog.

DF-0726 — if_cloners list / if_cloners_count unlocked race

Verdict

NOT REPRODUCED (code-confirmed race, too narrow to trigger in practice on this guest). The race condition is real at the source level — all four accessor functions (if_clone_attach, if_clone_detach, if_clone_list, if_clone_lookup) read/mutate the global if_cloners list and if_cloners_count without holding ifnet_lock — but three aggressive race attempts totaling ~265M unprivileged reader iterations and ~50k root kldload/kldunload cycles produced zero panics. The writer side requires root (kldload/kldunload), so the bug is not independently unprivileged triggerable; it is a cooperative race (unprivileged reader vs. root module activity). Impact ceiling if hit: kernel panic (DoS) via UAF read of unmapped module memory. No write primitive, no escalation path.

Mechanism (code-level trace, confirmed)

The shared state (no dedicated lock)

• sys/net/if_clone.c:43 — static LIST_HEAD(, if_clone) if_cloners (global linked list of registered interface cloners)
• sys/net/if_clone.c:44 — static int if_cloners_count (count of entries)

These globals have no dedicated lock. ifnet_lock() (a sleep mutex, ifnet_mtx at sys/net/if.c:195) exists and is used by some paths but is not held around the list/count accesses in the four functions below.

Reader (unprivileged)

• sys/net/if.c:2017-2018 — SIOCIFGCLONERS case in ifioctl(): calls if_clone_list() directly with no caps_priv_check (contrast SIOCIFCREATE at :2007 and SIOCIFDESTROY at :2013, which both require SYSCAP_RESTRICTEDROOT). Confirmed unprivileged — maxx (uid 1001) successfully invokes SIOCIFGCLONERS and gets the cloner list.
• sys/net/if_clone.c:201-230 — if_clone_list():
• :207 reads if_cloners_count (no lock)
• :216 reads if_cloners_count again (no lock, TOCTOU vs :207)
• :219-221 LIST_FIRST + LIST_NEXT traversal (no lock)
• :223 reads ifc->ifc_name (no lock — dereferences the list node)
• sys/net/if_clone.c:296-306 — if_clone_lookup():
• :300 LIST_FOREACH traversal (no lock)
• Called from if_clone_create() at :67 (before ifnet_lock() at :74) and if_clone_destroy() at :116 (after ifnet_unlock() at :112).

Writer (root-only, via kldload/kldunload)

• sys/net/if_clone.c:141-183 — if_clone_attach() (called from module MOD_LOAD):
• :147 LIST_FOREACH duplicate-name check (no lock)
• :166 LIST_INSERT_HEAD(&if_cloners, ifc, ifc_list) (no lock — before ifnet_lock() at :169)
• :167 if_cloners_count++ (no lock)
• The ifnet_lock() at :169 only covers the minifs allocation loop, not the list mutation.
• sys/net/if_clone.c:189-195 — if_clone_detach() (called from module MOD_UNLOAD):
• :192 LIST_REMOVE(ifc, ifc_list) (no lock)
• :193 kfree(ifc->ifc_units, M_CLONE) (no lock — frees the unit bitmap)
• :194 if_cloners_count-- (no lock)
• No ifnet_lock() at all in this function.

The UAF sink (page unmap)

• sys/kern/kern_linker.c:477-573 — linker_file_unload():
• :514 module_unload(mod) → calls the module's MOD_UNLOAD handler (e.g. tapmodevent at sys/net/tap/if_tap.c:190-201), which calls if_clone_detach(&tap_cloner) at if_tap.c:194.
• :556 file->ops->unload(file) → link_elf_obj_unload_file() at sys/kern/link_elf_obj.c:844.
• sys/kern/link_elf_obj.c:904 — vm_map_remove(kernel_map, ef->address, ...): unmaps the module's kernel virtual address range. After this, any access to tap_cloner (a static struct in if_tap.ko's .data section) or tap_cloner.ifc_name (a const char * pointing into if_tap.ko's .rodata) causes a kernel page fault → panic.

The race window

The dangerous window is between if_clone_detach() LIST_REMOVE (if_clone.c:192) and vm_map_remove() (link_elf_obj.c:904). This window spans: 1. The rest of the module's MOD_UNLOAD handler (e.g. tapdestroy loop, dev_ops cleanup). 2. module_release() + TAILQ_REMOVE from found_modules. 3. linker_file_sysuninit() (runs SYSUNINITs). 4. linker_file_unregister_sysctls(). 5. Freeing deps, common symbols. 6. file->ops->unload(file) → vm_map_remove.

This is potentially milliseconds of work — a wide writer window. However, the reader's vulnerable window per iteration is tiny: the time between LIST_NEXT(prev_cloner, ifc_list) returning &tap_cloner and the subsequent ifc->ifc_name read (a few instructions, ~50ns). Even though the reader completes ~200k ioctls/sec/thread, the per-iteration vulnerable window is so small that overlap with the writer's unload window is very rare.

The madvise(MADV_DONTNEED) technique in reader2.c attempts to widen the reader's window by forcing copyout() to take a page fault, but the fault is resolved quickly (the page is still in the page cache) and doesn't widen the window enough to hit the race in practice.

Reproduction attempts (all on unpatched #0 kernel)

Why it doesn't reproduce

1. Narrow reader window: ~50ns per iteration between getting a pointer to the detaching ifc and dereferencing its fields.
2. Writer requires root: kldload/kldunload need root privilege, so the race is cooperative (unprivileged reader + root writer), not independently unprivileged.
3. Page unmap is late: the vm_map_remove that actually makes the ifc pointer dangerous happens after a long chain of cleanup work, by which point most reader iterations have already completed their traversal.
4. The LIST_REMOVE itself doesn't zero ifc->ifc_list.le_next, so a reader already at the removed node can still follow the (stale but valid) next pointer to the next cloner — the UAF only bites if the module pages are unmapped while the reader is at the node.

This is consistent with the "Low" severity and "AC:H" (high attack complexity) in the CVSS vector.

Impact assessment

• If the race were hit: kernel panic (DoS) via UAF read of unmapped module memory during list traversal. No write primitive, no privilege escalation.
• Realistic trigger: requires an administrator to be actively loading/ unloading network interface modules while an unprivileged user hammers SIOCIFGCLONERS — a plausible but unusual sysadmin scenario.
• Not independently unprivileged: the writer side (kldload/kldunload) requires root.

Exploit chain

None. This is a race-condition read-side UAF with no write primitive. There is no escalation path to uid=0. The only impact is DoS (panic) if the race is hit, which requires root cooperation. Per the Phase 6 hard-blocker criteria, this is a read-only UAF with no write primitive — no chain to develop. The realistic impact ceiling is DoS.

Fix

fix.diff wraps all four functions' list/count accesses with ifnet_lock()/ifnet_unlock(): - if_clone_attach(): moved LIST_FOREACH dup check + LIST_INSERT_HEAD + count++ inside ifnet_lock() (merged with the existing lock for the minifs loop). Bitmap allocation stays outside the lock (M_WAITOK, though ifnet_lock is a sleep mutex so it would be safe either way). - if_clone_detach(): wrapped LIST_REMOVE + kfree(ifc_units) + count-- with ifnet_lock(). - if_clone_list(): wrapped count read + LIST_FOREACH traversal + copyout with ifnet_lock(). copyout under the sleep mutex is safe (consistent with existing usage where if_clone_createif is called under ifnet_lock). - if_clone_lookup(): wrapped LIST_FOREACH with ifnet_lock(). Callers (if_clone_create at :67, if_clone_destroy at :116) do NOT hold ifnet_lock at the call site, so acquiring it internally is safe.

Fix validation (Phase 8)

• Build: make -j6 nativekernel KERNCONF=X86_64_GENERIC → rc=0 (clean compile).
• Boot: installed kernel.stripped → kernel, rebooted → kern.version shows #1: Mon Jul 13 15:00:47 UTC 2026.
• Functional test (no regression):
• SIOCIFGCLONERS returns the correct 7-cloner list (lagg, carp, lo, gif, usbus, tun, wlan).
• kldload/kldunload of all 5 cloner modules (if_tap, if_vlan, if_gre, if_bridge, if_wg) works.
• 60s race (16 reader threads + 5-module writer cycle): no panic, guest up.
• Code-path closure: verified by source inspection — all four functions now hold ifnet_lock during list access.

The race was never observed to panic on the unpatched kernel, so the before/after behavioral contrast is "no panic / no panic". The fix validation is therefore functional (no regression) + code-path closure (verified by build + source inspection).

PoC changes

Created the entire evidence pack from scratch (the finding had no prior PoC folder): - reader.c — single-threaded SIOCIFGCLONERS hammer (unprivileged reader). - reader2.c — multi-threaded version with madvise(MADV_DONTNEED) to widen the copyout window via page faults. - build.sh / run.sh — exact build/run commands. - fix.diff — the verified fix (ifnet_lock wrapping all list accesses).