TOCTOU race in nge_jref vs nge_jfree: unlocked check-then-add enables refcount confusion / UAF on jumbo buffers
Summary
nge_jref at if_nge.c:1148-1164: reads nge_inuse==0 (unlocked), then atomic_add. nge_jfree :1183-1191 takes nge_jslot_serializer around subtract+SLIST_INSERT_HEAD. Race: jref reads inuse=1 -> jfree subtracts to 0, inserts on free list -> jref atomic_add back to 1 -> slot on free list AND in-use -> nge_jalloc hands same slot to new RX desc while original mbuf still references it -> UAF. Trigger: m_ext sharing (m_copym/m_dup_pkthdr) + concurrent free. Fix: take nge_jslot_serializer around check+increment in nge_jref.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1384 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
DF-1384 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
TOCTOU race in nge_jref vs nge_jfree: unlocked check-then-add enables refcount confusion / UAF on jumbo buffers
Source Location
sys/dev/netif/nge/if_nge.c:1148-1192
Verdict
Source-confirmed (complex fix): TOCTOU race in nge_jref vs nge_jfree: unlocked check-then-add enables . No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
nge_jref at if_nge.c:1148-1164: reads nge_inuse==0 (unlocked), then atomic_add. nge_jfree :1183-1191 takes nge_jslot_serializer around subtract+SLIST_INSERT_HEAD. Race: jref reads inuse=1 -> jfree subtracts to 0, inserts on free list -> jref atomic_add back to 1 -> slot on free list AND in-use -> nge_jalloc hands same slot to new RX desc while original mbuf still references it -> UAF. Trigger: m_ext sharing (m_copym/m_dup_pkthdr) + concurrent free. Fix: take nge_jslot_serializer around check+inc
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: nge_jref vs nge_jfree unlocked check-then-add TOCTOU race on jumbo buffer refcount enables UAF. Complex fix (needs locking redesign). HW-gated.
Verified recommended fix
Source-confirmed: nge_jref vs nge_jfree unlocked check-then-add TOCTOU race on jumbo buffer refcount enables UAF. Complex fix (needs locking redesign). HW-gated.
Verdict
Source-confirmed: nge_jref vs nge_jfree unlocked check-then-add TOCTOU race on jumbo buffer refcount enables UAF. Complex fix (needs locking redesign). HW-gated.
No comments yet.