DF-3292 — SIOCS80211 MESH_RTCMD ADD/DELETE dereference the user-supplied ireq->i_data pointer directly in kernel

File: sys/netproto/802_11/wlan/ieee80211_mesh.c (pass 2 audit)

What

mesh_ioctl_set80211 (:3653-3663):

case IEEE80211_MESH_RTCMD_ADD:
        if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ireq->i_data) ||   /* raw user ptr */
            IEEE80211_ADDR_EQ(broadcastaddr, ireq->i_data))      /* raw user ptr */
                return EINVAL;
        error = copyin(ireq->i_data, &tmpaddr, IEEE80211_ADDR_LEN);  /* proper copyin AFTER */
        ...
case IEEE80211_MESH_RTCMD_DELETE:
        ieee80211_mesh_rt_del(vap, ireq->i_data);                /* raw user ptr, NO copyin at all */

IEEE80211_ADDR_EQ reads 6 bytes from i_data in kernel context. i_data is a user-controlled pointer from the ioctl (SIOCS80211, requires SYSCAP_NONET_WIFI — checked at ieee80211_ioctl.c:3472).

Consequences for a privileged caller: * passing an invalid/unmapped kernel address → kernel page fault → panic (privileged local DoS; verified at runtime, see below); * passing any mapped kernel address → 6 bytes of arbitrary kernel memory compared against routing-table destinations — an arbitrary-address 6-byte read gadget whose side effect (route deleted or not) is observable, i.e. a constrained kernel-memory oracle; * on the DELETE path there is no copyin at all — robustness/standards bug (user pages must not be dereferenced directly; breaks under SMAP-capable platforms and colliding mappings).

Runtime (fixed-kernel guest — bug path untouched by the 7-fix diff)

# ./setmeshdel wlan0
issuing MESH_RTCMD_DELETE with kernel i_data=0xffffffff81234000...
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xffffffff81234000

(panic.txt)

Build / run

sh findings/poc/DF-3286/build.sh && vm.sh run_root "cc -o /root/fwm/setmeshdel /root/fwm/setmeshdel.c"
sh findings/poc/DF-3292/run.sh

Fix

copyin the 6-byte address first, compare/delete the kernel copy (same discipline the ADD path uses after its check).

Severity Low (privileged-only, but a raw user/kernel-pointer deref). CWE-822.

DF-3292 VERDICT — REPRODUCED (privileged local panic; raw user-pointer deref in kernel)

Reproduction (fixed-kernel guest; the 7-fix diff does not touch this path)

Mesh vap up; root runs:

# ./setmeshdel wlan0
issuing MESH_RTCMD_DELETE with kernel i_data=0xffffffff81234000...

Serial console:

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xffffffff81234000
...ieee80211_mesh_rt_del / mesh_ioctl_set80211 trace...
(see panic.txt)

Root cause certain from source: mesh.c:3663 passes ireq->i_data (user-controlled pointer) straight into ieee80211_mesh_rt_del which reads 6 bytes from it (IEEE80211_ADDR_EQ at :377) with no copyin; the ADD path's pre-check at :3654 derefs i_data raw as well (its later copyin is correct). Requires SYSCAP_NONET_WIFI (SIOCS80211 gate at ieee80211_ioctl.c:3472) → privileged local DoS + arbitrary-kernel- address 6-byte read oracle (route-deleted/not side channel).

Impact ceiling

Privileged panic + constrained kernel read oracle; robustness defect (direct user-page deref). Low severity.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)