DF-3278 — bridge_fragment() double-free / UAF on M_PREPEND failure

What

if_bridge.c:4386-4405: if any M_PREPEND(m0, ..., M_NOWAIT) fails while re-attaching Ethernet headers to an ip_fragment() chain, - the failed fragment m0 is freed by the M_PREPEND macro itself, - the else m_freem(m) branch then frees fragment #1 for EVERY remaining iteration (double free), and - the loop increment reads m0->m_nextpkt of freed memory (UAF read).

Preconditions: pfil hooks loaded (ipfw/pf), forwarded packet larger than the egress member's MTU, and a transient m_gethdr(M_NOWAIT) failure at the wrong instant.

Reproduce (guest, as root)

cd /root/poc/df-3278
cc -O -o frag_flood frag_flood.c
sh run.sh                 # kldload ipfw, mtu-600 members, flood
./frag_flood 3000000 drain   # heavy variant: also pins mbuf clusters

Status

NOT reproduced deterministically (allocation-failure window could not be forced from userland); the fragment path itself was verified live: 500,050 datagrams fragmented through bridge_fragment and the cluster pool driven to exhaustion (objcache(mbuf cluster) exhausted). See VERDICT.md for the full code-path proof.

DF-3278 — VERDICT

NOT REPRODUCED within the guest budget — but the defect is code-certain and the vulnerable path was driven live at scale. Classified not_reproduced (window not hit), not false_positive.

The defect (code analysis, certain)

bridge_fragment() (sys/net/bridge/if_bridge.c:4367-4416):

    error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
            CSUM_DELAY_IP);
    if (error)
        goto out;
    for (m0 = m; m0; m0 = m0->m_nextpkt) {          /* (C) UAF read */
        if (error == 0) {
            if (snap) {
                M_PREPEND(m0, sizeof(struct llc), M_NOWAIT);
                if (m0 == NULL) { error = ENOBUFS; continue; }  /* (A) */
                ...
            }
            M_PREPEND(m0, ETHER_HDR_LEN, M_NOWAIT);
            if (m0 == NULL) { error = ENOBUFS; continue; }      /* (A) */
            bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
        } else
            m_freem(m);                               /* (B) double free */
    }

• (A) M_PREPEND on M_NOWAIT allocation failure frees the mbuf chain and leaves the variable NULL (sys/sys/mbuf.h:463-479; m_prepend() does m_freem(m); return NULL, sys/kern/uipc_mbuf.c:1508-1511).
• After the first failure, error = ENOBUFS, so every subsequent loop iteration takes the else branch and calls m_freem(m) where m is fragment #1 — already freed in the failing iteration if the failure was on fragment #1, or freed on the first else iteration and then freed AGAIN on every following one (fragment chains of N ≥ 3 give N−2 double frees).
• (C) the loop increment m0 = m0->m_nextpkt reads the m_nextpkt of the mbuf just freed by M_PREPEND — a use-after-free read.

Reachability (verified live on the guest)

bridge_fragment() is called only from bridge_pfil() (if_bridge.c:4115-4121) on the member-OUT path when pfil_member is set, inet pfil hooks are registered, and m_pkthdr.len > member if_mtu. All preconditions were established and verified:

• kldload ipfw + ipfw add 100 allow all from any to any (ipfw2 initialized; inet_pfil_hook.ph_hashooks > 0).
• bridge0 with both members at MTU 600; injector writes valid-IP 1500-byte UDP frames into tap0.
• Verified: 50/50 test frames fragmented (netstat -s -p ip: "50 output datagrams fragmented"); a 6×500,000-frame flood pushed 500,050 datagrams through bridge_fragment with zero bad sums.
• To force the M_NOWAIT failure, kernel mbuf clusters were pinned via 8 UDP loopback sockets with 2 MB SO_RCVBUF never read (kern.ipc.maxsockbuf raised to 8 MB): serial console showed Warning: objcache(mbuf cluster) exhausted on cpu1..cpu5.
• Under this pressure the fragment re-header loop was exercised, but the exact instant where m_prepend() must allocate (fragment with zero leading space) AND the allocation fails was never observed: both heavy attempts ended with the box wedged by cluster exhaustion (mbuf starvation DoS from the drainer itself) rather than the targeted double free. Deterministically forcing a per-cpu objcache failure at one specific allocation site is not possible from userland without kernel knobs.

Impact if triggered

Kernel heap double-free / UAF read on M_DEVBUF mbufs, driven by forwarded traffic, preconditions = root-configured bridging with pfil (ipfw/pf) and an MTU-mismatched member plus transient mbuf pressure. Given the guest's lack of SMAP/SMEP/KASLR this is plausibly exploitable, but no exploit was developed since the primitive itself could not be fired.

Files

• frag_flood.c — final injector (valid checksum — computed byte-wise; an earlier version's LE-word sum and a strict-aliasing reorder each produced invalid checksums that bridge_ip_checkbasic dropped, which is why early runs showed zero fragmentation).
• run.sh — setup + flood.
• run.log — counters proving the fragment path ran at scale + the exhaustion warnings.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.