output_ifp stored without ifnet lifetime protection UAF on interface detach
Summary
ng_source_store_output_ifp does sc->output_ifp=ifp(:623) with only ifnet_lock held transiently for ifunit lookup NO reference on struct ifnet DragonFly has no if_ref() API. Pointer dereferenced locklessly by periodic callout ng_source_intr ifq_get_subq_default(&sc->output_ifp->if_snd)(:740-743). If interface detached(USB unplug vlan/bridge destroy) struct ifnet freed while sc->output_ifp still points next START->callout->ng_source_intr touches freed memory softirq context. Latent file not built by default. [VERIFIED pass2: reproduced - no reference on output_ifp, verbatim intr read path dereferences freed ifnet stand-in while live-lo0 control works; interface-destroy trigger, latent file]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2599 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| harness.c | — | 7.6 KB | view raw | |
| run.log | — | 605 B | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
ngsource_456.log mode 5/6: live vs post-free output_ifp->if_snd read
PoC changes
freed-stand-in ifnet; real store + verbatim intr lines
Verified recommended fix
revalidate output_ifp via ifunit at use or clear it on ifnet detach
Verdict
output_ifp stored with no reference (ng_source.c:623); ng_source_intr (:739-743) dereferences it from a callout after the interface may be destroyed. Live lo0 deref works; post-free stand-in deref returned ifsq=0 from freed memory (verbatim read path). Real trigger: ifconfig destroy between SETIFACE and START. netgraph7 is not in the stock kernel (DF-2539); ng_source.c is additionally absent from sys/conf/files and cannot compile as-is (:743 undeclared ifq). The harness module compiles the pristine file with only the documented build adaptations (:743 ifq->ifsq; DFly API renames IF_ENQUEUE/altq/ifq_var includes); ng7 core (netgraph.ko) kldloaded for the framework.
No comments yet.