DF-1249 — dc_pnic_rx_bug_war unbounded copy loop (heap overflow if PNIC produces >5 fragments)

Verdict

SOURCE-CONFIRMED (real code-level hardening gap, speculative exploitation), INCONCLUSIVE at runtime — the if_dc driver IS compiled into the running GENERIC kernel, but the guest's NIC is vtnet0 (virtio-net); no DEC 21143 / PNIC 82c168/82c169 NIC is attached, so dc_pnic_rx_bug_war is never called. Fix authored and compile-validated.

Mechanism (source trace)

dc_pnic_rx_bug_war() salvages a corrupted multi-fragment RX frame from the PNIC chip bug by copying fragments into a fixed salvage buffer:

• sys/dev/netif/dc/if_dc.c:1976 — sc->dc_pnic_rx_buf = kmalloc(DC_RXLEN * 5, M_DEVBUF, M_WAITOK); → buffer is 7680 bytes (5 × 1536).
• sys/dev/netif/dc/if_dc.c:2414-2429: ptr = sc->dc_pnic_rx_buf; /* 7680-byte buffer */ bzero(ptr, DC_RXLEN * 5); while (1) { c = &sc->dc_ldata->dc_rx_list[i]; rxstat = c->dc_status; m = sc->dc_cdata.dc_rx_chain[i]; bcopy(mtod(m, char *), ptr, DC_RXLEN); /* copies 1536 bytes each iteration */ ptr += DC_RXLEN; /* advances 1536, NO bound check */ if (i == idx || rxstat & DC_RXSTAT_LASTFRAG) break; dc_newbuf(sc, i, m); DC_INC(i, DC_RX_LIST_CNT); /* ring is 64 or 192 descriptors */ }
• The loop's only termination is i == idx (reaching the LASTFRAG descriptor index) or rxstat & LASTFRAG. There is no cap on the number of iterations. The caller (if_dc.c:2525-2533) enters this path when FIRSTFRAG and LASTFRAG are not both set in the same descriptor, walking from the saved FIRSTFRAG index to the LASTFRAG index.
• If the PNIC chip (or a corrupted descriptor ring) yields more than 5 fragments between FIRSTFRAG and LASTFRAG, ptr walks past the end of the 7680-byte dc_pnic_rx_buf into adjacent kernel heap. The ring (DC_RX_LIST_CNT = 64 or 192, if_dcreg.h:459/461) bounds the worst case to 64–192 iterations ⇒ up to ~98KB–294KB of overflow.
• Additionally total_len = DC_RXBYTES(rxstat) (if_dc.c:2432, 14-bit) is used unchecked in bcopy(ptr, mtod(m,char*), total_len) at line 2453.

Why not reproduced at runtime

• Guest NIC is vtnet0 (virtio-net). The dc driver probe never matches a virtio device, so no dc_softc with DC_PNIC_RX_BUG_WAR is ever instantiated.
• The PNIC RX-bug war is gated by sc->dc_flags & DC_PNIC_RX_BUG_WAR, set only for DC_TYPE_PNIC (if_dc.c:1973-1975), which requires a Lite-On 82c168/82c169 chip.
• The finding's own confidence is speculative: it requires the PNIC chip to produce >5 descriptors for a single corrupted RX event (worse than the known bug the war was written to handle). This is a driver-robustness issue against misbehaving hardware, not an unprivileged-user-reachable bug.

Fix (fix.diff, compile-validated)

Cap the loop at 5 iterations (matching the DC_RXLEN * 5 buffer) so a misbehaving PNIC cannot overflow the salvage buffer. The patched if_dc.c builds cleanly into if_dc.ko (52696 bytes) with gcc 8.3, -Werror.

Realistic impact ceiling

Kernel heap overflow from a misbehaving PNIC NIC (worst-case ~294KB overflow). On this guest: not reachable (vtnet0 NIC, no PNIC). Defense-in-depth driver hardening.