• File: sys/dev/netif/wb/if_wb.c
• Lines: 1221, 1248, 1274, 1275, 1276, 1277, 1279, 1284, 1285
• Severity: High
• CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
• CWE: CWE-787 Out-of-bounds Write
• Confidence: likely

Summary

wb_encap() packs an outgoing mbuf chain into a fixed 16-slot wb_frag[] array. The for-loop at line 1221 caps frag at WB_MAXFRAGS (16) via an early break, but the WB_MIN_FRAMELEN padding branch at line 1274 then indexes wb_frag[frag] without re-checking frag, so when exactly 16 non-empty mbufs were consumed (loop exits with frag==16, m==NULL, coalesce branch skipped) AND total_len < 60, the code writes 12 bytes (wb_status/wb_ctl/wb_data) plus a read-modify-write of wb_ctl (line 1285 via WB_TXCTL macro at wb_lastdesc==16) into wb_frag[16], one full wb_txdesc (256 bytes) past c->wb_ptr.

Root cause

wb_encap() at sys/dev/netif/wb/if_wb.c:1221-1238 fills wb_frag[] until if (frag == WB_MAXFRAGS) break; (line 1223).

For a chain of exactly 16 non-empty mbufs whose m_len sum is < WB_MIN_FRAMELEN (60), the loop exits naturally with m==NULL and frag==16, so the coalesce fallback at line 1248 (if (m != NULL)) is NOT taken.

Control then falls into the padding branch at line 1274:

if (total_len < WB_MIN_FRAMELEN) {
    f = &c->wb_ptr->wb_frag[frag];     /* frag == 16, OOB */
    ...
}

with frag==16. wb_frag is declared struct wb_desc wb_frag[WB_MAXFRAGS] (WB_MAXFRAGS==16) at if_wbreg.h:291, so wb_frag[16] is one-past-end.

Concretely the driver writes:

• f->wb_ctl = WB_MIN_FRAMELEN - total_len (line 1276)
• f->wb_data = vtophys(&sc->wb_cdata.wb_pad) (line 1277)
• f->wb_status = WB_TXSTAT_OWN (line 1279)
• frag++ → 17 (line 1280)
• c->wb_lastdesc = frag - 1 = 16 (line 1284)
• WB_TXCTL(c) |= WB_TXCTL_LASTFRAG (line 1285) expands (via if_wbreg.h:296) to c->wb_ptr->wb_frag[16].wb_ctl |= WB_TXCTL_LASTFRAG — a further OOB read-modify-write.

WB_MAXFRAGS is 16 (if_wbreg.h:271). The next wb_txdesc in wb_tx_list[] begins exactly at the wb_frag[16] offset (sizeof(struct wb_txdesc) == 16*sizeof(struct wb_desc) == 256), so the OOB either corrupts the next in-flight TX descriptor (common case) or, when c->wb_ptr == &wb_ldata->wb_tx_list[127] (last descriptor), writes past the contigmalloc region — which was sized only sizeof(struct wb_list_data) + 8 (line 779), so the f->wb_data write at OOB offset 8 is a 4-byte write into the kernel heap.

Threat

Local unprivileged user on a system with a wb(4) interface (Winbond W89C840F / Compex RL100-ATX NIC, or the device exposed to a VM) that can construct an outgoing packet whose mbuf chain has exactly 16 non-empty mbufs totaling < 60 bytes.

The 4-12 byte OOB write of partially-controlled data (a kernel physical address from vtophys(&wb_pad), plus fixed flags WB_TXSTAT_OWN=0x80000000 and WB_TXCTL_TLINK|WB_TXCTL_LASTFRAG) can corrupt a sibling TX descriptor the chip is concurrently DMA-ing from (packet corruption / chip-follows-stale-wb_next / panic) or, with TX-ring grooming that drives wb_tx_free to chain[127], land a 4-byte heap write past the contigmalloc allocation.

With heap grooming the write can be directed at an adjacent kernel object to escalate to arbitrary kernel write.

Even absent escalation, the chip DMAing from a corrupted descriptor is a reliable kernel panic (A:H).

wb_start also ignores wb_encap's return value (line 1327), so a failing encap still queues the descriptor, compounding the corruption.

Exploit / PoC

PoC plan (drop into findings/poc/DF-1487/):

1. trigger.c — open AF_INET SOCK_DGRAM socket bound to a wb interface address; build a 16-entry iov via sendmsg() with each iov_base pointing at a 1-byte buffer (iov_len=1) for a 16-byte user payload; target a destination on the wb segment so ether_output fires.

If the local UDP/IP prepend produces a 17th mbuf, fall back to: trigger_bpf.c — open /dev/bpfN on the wb interface and write a hand-crafted 16-mbuf chain via a kernel helper, OR trigger_raw.c — use AF_INET SOCK_RAW with IP_HDRINCL and craft the IP header inline in the first iov so the network layer does not prepend.

The decisive condition is exactly 16 mbufs with sum(m_len) < 60 in the chain handed to wb_start.

2. Build on DragonFlyBSD: cc -O2 -o trigger trigger.c.
3. Run: ./trigger — observe panic in dmesg (panic comes from the chip following a corrupted wb_next pointer or from a corrupted wb_data physical address) or, with KASAN/KMSAN enabled, a clear OOB write report at if_wb.c:1275-1279.
4. For the heap-OOB variant (c->wb_ptr == wb_tx_list[127]), first flood the interface with 127 small UDP packets to advance wb_tx_free to chain[127], pause to let the chip drain (or block TX via ifconfig down/up), then fire the 16-fragment trigger so its descriptor lands at chain[127]; KASAN will report the write past the contigmalloc allocation.

Success criterion: kernel panic with stack through wb_encap+wb_start, or KASAN OOB write at the cited lines.

Recommended fix

Validate frag in the padding branch and refuse (or coalesce) instead of overflowing. Minimal diff against sys/dev/netif/wb/if_wb.c:

--- a/sys/dev/netif/wb/if_wb.c
+++ b/sys/dev/netif/wb/if_wb.c
@@ -1271,6 +1271,17 @@ wb_encap(struct wb_softc *sc, struct wb_chain *c, struct mbuf *m_head)
        frag = 1;
    }

+   /*
+    * We can only fit WB_MAXFRAGS fragments per super-descriptor. If the
+    * chain filled every slot (frag == WB_MAXFRAGS) and still needs a
+    * runt-padding fragment, the fragment array cannot hold it -- bail out
+    * so wb_start can drop the packet instead of writing past wb_frag[].
+    */
+   if (frag >= WB_MAXFRAGS && total_len < WB_MIN_FRAMELEN) {
+       m_freem(m_head);
+       return (1);
+   }
+
    if (total_len < WB_MIN_FRAMELEN) {
        f = &c->wb_ptr->wb_frag[frag];
        f->wb_ctl = WB_MIN_FRAMELEN - total_len;
@@ -1324,7 +1335,15 @@ wb_start(struct ifnet *ifp, struct ifaltq_subque *ifsq)
        sc->wb_cdata.wb_tx_free = cur_tx->wb_nextdesc;

        /* Pack the data into the descriptor. */
-       wb_encap(sc, cur_tx, m_head);
+       if (wb_encap(sc, cur_tx, m_head) != 0) {
+           /*
+            * Encap failed (e.g. fragment array would overflow).
+            * cur_tx was not consumed; m_head was already freed by
+            * wb_encap on this error path. Stop dequeuing.
+            */
+           ifp->if_oerrors++;
+           break;
+       }

        if (cur_tx != start_tx)
            WB_TXOWN(cur_tx) = WB_TXSTAT_OWN;

The first hunk makes wb_encap return failure (1) when it would otherwise index wb_frag[16]; the second makes wb_start honor that return value (it currently ignores it) so the corrupt descriptor is never queued to the chip.

A more aggressive fix would also extend the if (m != NULL) coalesce branch at line 1248 to trigger on (frag == WB_MAXFRAGS) regardless of m, so the packet is still transmitted via a single coalesced cluster instead of being dropped — but the minimal diff above is sufficient to close the memory-safety hole.

Note on RX path (deliberately NOT a finding)

The RX length handling in wb_rxeof (lines 982–986) DOES enforce WB_RXBYTES <= 1536 AND >= WB_MIN_FRAMELEN, and the buffer is WB_BUFBYTES = 4096 bytes. So the missing-MCLBYTES pattern (DF-1410/DF-1478/ DF-1481) does NOT apply to this driver — only the TX-side wb_encap OOB write above is a security issue in if_wb.c.