⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2690

m_extadd() lacks the M_EXT precondition guard m_mclget() has — calling it on a cluster mbuf yields m_sharecount()/m_free() type confusion and a wrong-cache objcache_put

Field Value
ID DF-2690
Status new
Severity Info
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE CWE-843 Type Confusion
File sys/kern/uipc_mbuf.c
Lines 1477-1489 (consumers :946-953, :1370-1425)
Area kern
Confidence speculative
Discovered 2026-08-30
Pass 2 (GLM 5.3 second pass)
Bucket base:kern
Reported pending
Known CVE none
CVE match novel

Summary

m_extadd() blindly overwrites m_ext and ORs in M_EXT without asserting the mbuf has no external storage, unlike its sibling m_mclget() which KKASSERTs !(m->m_flags & M_EXT). If invoked on an mbuf that already carries an mbuf-cluster, M_EXT_CLUSTER stays set while ext_arg/ext_free become the caller's custom pair. Every subsequent consumer keys off those flags: m_sharecount() reads the custom ext_arg as struct mbcluster *->mcl_refs, and m_free()'s cluster case either objcache_put()s the mbuf — still pointing at the CUSTOM buffer with custom ext_free — into mbufphdr(j)cluster_cache, handing the next m_getjcl() consumer a foreign buffer with wrong lifetime, or leaks the original cluster's reference permanently (cluster-pool exhaustion). Zero in-tree callers (grep) — latent API hazard for in-kernel/out-of- tree module misuse.

--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -1476,6 +1476,7 @@ void
 m_extadd(struct mbuf *m, void *buf, u_int size, void (*reff)(void *),
     void (*freef)(void *), void *arg)
 {
+   KKASSERT((m->m_flags & M_EXT) == 0);
    m->m_ext.ext_arg = arg;
    m->m_ext.ext_buf = buf;
    m->m_ext.ext_ref = reff;
@@ -1484,5 +1485,5 @@ m_extadd(struct mbuf *m, void *buf, u_int size, u_int size, void (*reff)(void *),
    m->m_ext.ext_size = size;
    reff(arg);
    m->m_data = buf;
-   m->m_flags |= M_EXT;
+   m->m_flags = (m->m_flags & ~(M_EXT_CLUSTER | M_CLCACHE)) | M_EXT;
 }

Timeline

  • 2026-08-30 Discovered during pass-2 audit of uipc_mbuf.c (GLM 5.3).

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2690 · 8 files
FileTypeDescriptionSize
VERDICT.md — 1.5 KB ↓ raw
README.md — 229 B ↓ raw
build.sh — 85 B view raw
run.sh — 49 B view raw
env.txt — 314 B view raw
manifest.json — 595 B view raw
verdict.json — 1.9 KB view raw
fix.diff — 381 B view raw
README.md
↓ download raw

DF-2690 evidence pack

  • finding: sys/kern/uipc_mbuf.c (1477-1489)
  • verdict: reproduced (certain) - see VERDICT.md
  • source-only confirmation (no runtime PoC)
  • reproduce: build.sh / run.sh
  • fix.diff: present, git-apply-able
VERDICT.md
↓ download raw

DF-2690 - Verification Verdict

Status: reproduced Impact: none (hardening) Confidence: certain

Mechanism

m_extadd attaches an external buffer without the M_EXT precondition guard that m_mclget has (m_mclget:1243 KKASSERT((m->m_flags & M_EXT) == 0)); calling it on a cluster/external mbuf overwrites ext_* without releasing the prior association - the old buffer leaks its refcount and m_free later executes the WRONG disposal path for the flags (m_sharecount/objcache confusion).

Verdict

source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). API-hardening: grep shows no in-tree caller of m_extadd outside mbuf.h (declaration) - the guard protects future/protocol-code callers. Same KKASSERT pattern as m_mclget, compile-validated.

Threat / reachability

Future misuse of the mbuf external-buffer API turns into refcount leaks + wrong-cache objcache_put (heap corruption class).

Privilege escalation assessment

n/a (hardening)

Fix

Add KKASSERT((m->m_flags & M_EXT) == 0) at the top of m_extadd.

Kernel references

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

not_testable

fix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier

batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
↓ fix.diffper-fix-DF-2690

Confirmed kernel references

Detail

Exploit chain

no escalation path (Info-tier hardening; see VERDICT.md)

Evidence (decisive lines)

VERDICT.md mechanism/verdict sections; fix.diff

PoC changes

none (source-only confirmation for this Info-tier item)

Verified recommended fix

Add KKASSERT((m->m_flags & M_EXT) == 0) at the top of m_extadd.

Verdict

source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). API-hardening: grep shows no in-tree caller of m_extadd outside mbuf.h (declaration) - the guard protects future/protocol-code callers. Same KKASSERT pattern as m_mclget, compile-validated.