DF-0751 — MPLS explicit-NULL infinite loop — PoC & evidence pack

TL;DR

A single MPLS Ethernet frame (EtherType 0x8847, label=0 or 2, S-bit CLEAR) causes mpls_input() (sys/netproto/mpls/mpls_input.c) to enter an infinite goto again loop because the mbuf cursor is never advanced (m_adj is missing). One CPU pegs at 100% holding the mplock; the kernel freezes silently (no panic, no dmesg). Power-cycle required. Remote unauthenticated on-link DoS.

Verdict: REPRODUCED (live + harness). Fix VALIDATED.

Files

Reproduce

Path A — harness (deterministic, no module load, unprivileged)

./build.sh harness     # cc -O2 -o mpls_loop_harness mpls_loop_harness.c
./run.sh   harness     # ./mpls_loop_harness

Expected: *** INFINITE LOOP CONFIRMED *** (1,000,001 iterations, cursor never advances) for the unpatched loop; loop TERMINATES cleanly for the patched loop.

Path B — live kernel wedge (requires root on guest, needs mpls.ko)

./build.sh module      # builds mpls.ko from /usr/src (Makefile included)
./run.sh   module      # kldload + fire trigger; guest wedges — vm.sh reset to recover

WARNING: Path B hard-wedges the guest. Only run if you can power-cycle. The harness (Path A) is the recommended deterministic proof.

Fix validation

cd /usr/src && patch -p1 < fix.diff                              # apply fix
cd sys/netproto/mpls && make && cp mpls.ko /boot/kernel/          # rebuild
kldload mpls.ko                                                   # load patched
/root/mpls_trigger vtnet0                                         # re-run trigger
# guest stays alive — fix is effective

DF-0751 — MPLS explicit-NULL label 0/2 infinite loop (single-packet remote DoS)

Verdict: REPRODUCED (live kernel + harness) — FIX VALIDATED

Impact: dos / hard-hang. A single MPLS Ethernet frame (EtherType 0x8847, label=0 or label=2 with the bottom-of-stack bit CLEAR) drives mpls_input() into an infinite goto again loop that never advances the mbuf cursor, pinning one CPU's netisr thread at 100% while holding the mplock. No panic, no dmesg, no recovery short of power-cycling the guest. Remote unauthenticated on-link attacker. exploit_chain: none (pure busy-loop DoS — no memory corruption, no escalation primitive).

The bug (confirmed line-by-line in sys/netproto/mpls/mpls_input.c)

The mpls_input() label-switch loop at mpls_input.c:88-171:

again:                                          // :101
    mpls = mtod(m, struct mpls*);               // :110  — reads CURRENT label
    label = MPLS_LABEL(ntohl(mpls->mpls_shim)); // :111
    switch (label) {
    case 0:                                     // :113  — IPv4 explicit NULL
        if (MPLS_STACK(ntohl(mpls->mpls_shim))) {  // :117 — S-bit set?
            m_adj(m, sizeof(struct mpls));      // :119  — CORRECT: advance
            netisr_queue(NETISR_IP, m);
            return;
        }
        goto again;   // :123  *** BUG: NO m_adj before goto ***

    case 2:                                     // :132  — IPv6 explicit NULL
        if (MPLS_STACK(ntohl(mpls->mpls_shim))) {  // :136
            m_adj(m, sizeof(struct mpls));      // :138  — CORRECT
            netisr_queue(NETISR_IPV6, m);
            return;
        }
        goto again;   // :142  *** BUG: NO m_adj before goto ***

On the S-bit-CLEAR path, goto again jumps back to :101 without calling m_adj(m, sizeof(struct mpls)). mtod(m) therefore returns the same pointer every iteration, the same mpls_shim is re-read, the same case 0 branch is taken, and the loop never terminates. There is no depth counter, no iteration cap, no TTL decrement anywhere in mpls_input() or its caller. The caller mpls_input_handler() (:77-85) only does get_mplock() / mpls_input() / rel_mplock(), so the spinning thread holds the mplock forever, wedging the whole kernel.

Reachability

MPLS is optional mpls (sys/conf/files:1865-1868) and is not compiled into X86_64_GENERIC (no mpls symbols in /boot/kernel/kernel). However it builds cleanly as a KLD module (mpls.ko) — the audit guest has full /usr/src and gcc 8.3. An administrator who needs MPLS (kldload mpls) gets the vulnerable code path.

The dispatch chain (all verified in source): - sys/net/if_ethersubr.c:1146-1150 — ETHERTYPE_MPLS (0x8847) → NETISR_MPLS - sys/netproto/mpls/mpls_proto.c — DOMAIN_SET(mpls) → mpls_init() via pr_init - mpls_input.c:73 — netisr_register(NETISR_MPLS, mpls_input_handler, mpls_hashfn) - mpls_demux.c:mpls_hashfn — only checks >= 4 bytes (mpls_lengthcheck) and reads the first label for hashing. No depth validation.

Reproduction — TWO independent proofs

Proof 1: Live kernel (guest hard-wedge)

1. Built mpls.ko from clean /usr/src/sys/netproto/mpls (Makefile: KMOD=mpls; SRCS=mpls_demux.c mpls_input.c mpls_output.c mpls_proto.c; .include <bsd.kmod.mk>). cc 8.3 [DragonFly].
2. kldload mpls.ko — registers NETISR_MPLS handler.
3. Injected one MPLS frame via bpf write with BIOCSFEEDBACK on vtnet0: - Ethernet header: dst ff:ff:ff:ff:ff:ff, src 52:54:00:12:34:56, EtherType 0x8847 - MPLS shim (network byte order): 00 00 00 40 → label=0, exp=0, S=0, TTL=64
4. Result: guest hard-wedged. vm.sh status → down. ssh → RC=124 (timeout). Zero panics in boot.log (silent busy-loop, NOT a crash). boot.log frozen at boot timestamp — the kernel could not write to the serial console. Power-cycle (vm.sh reset) required to recover.

Proof 2: Deterministic harness (faithful loop transcription)

mpls_loop_harness.c embeds the mpls_input() label-switch loop verbatim with userspace stand-ins for mbuf/mtod/m_adj/netisr_queue. The only addition is a depth-counter escape hatch (cap = 1,000,000) the production code lacks. Run as unprivileged user maxx:

Frame A: label=0 S=0 TTL=64
UNPATCHED: iterations=1000001  exit=DEPTH CAP HIT (would loop forever)
           cursor adv: off=0 (NEVER ADVANCED — same label re-read every iter)
           VERDICT: *** INFINITE LOOP CONFIRMED ***
PATCHED:   iterations=10  exit=m_pullup too small -> drop  cursor adv=off=36
           VERDICT: loop TERMINATES cleanly. Fix is effective.

Frame B: label=2 S=0 (IPv6 explicit NULL, mpls_input.c:142)
UNPATCHED: iterations=1000001  VERDICT: *** INFINITE LOOP CONFIRMED ***

Control: label=0 S=1 (bottom-of-stack)
UNPATCHED: iterations=1  exit=netisr_queue(NETISR_IP) -> return
           VERDICT: terminates (S-bit path is correct)

Impact ceiling

Remote unauthenticated on-link single-frame hard hang. One CPU pinned at 100% holding mplock → entire kernel unresponsive. No panic, no log, no auto-recovery. This is a pure availability denial — no memory corruption, no read/write primitive, no privilege escalation. exploit_chain: none.

CVSS AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High) is appropriate.

The fix (validated — fix.diff)

Two-part defence-in-depth, both targeting the root cause:

1. m_adj(m, sizeof(struct mpls)) before each goto again (:134 and :155 post-patch) — advances the mbuf cursor so the next iteration reads the next label on the stack, matching the S-bit-set path at :119/::138.

2. Depth cap (MPLS_LABEL_TTL_MAX = 32) — a counter incremented each iteration; if exceeded, mplss_invalid++ / m_freem / return. Prevents unbounded looping even if another label-switch path is later added without m_adj. RFC 3032 doesn't bound the stack, but legitimate stacks are a handful deep; 32 is generous (matches other BSDs).

Fix validation (Phase 8 — single-fix module built + booted)

The fix closes the bug completely. The harness corroborates: the patched loop terminates in 10 iterations (cursor advances 0→36, then m_pullup fails on the exhausted buffer → clean drop).