DF-3315 — in_pcblist_range: unsynchronized pcblist walk of non-shared pcbinfo (non-atomic marker dance)

What

in_pcblist_range() (sys/netinet/in_pcb.c:2408-2495) exports pcb lists via sysctl (net.inet.raw.pcblist, net.inet.udp.pcblist). For a pcbinfo initialized without a shared infotoken — ripcbinfo (raw_ip.c:115 in_pcbinfo_init(&ripcbinfo, 0, FALSE)) — GET_PCBINFO_TOKEN() is a no-op (in_pcb.h:439-449), so the walk has no synchronization at all.

The walk advances its list marker with a non-atomic two-step dance:

while ((inp = LIST_NEXT(marker, inp_list)) != NULL && i < n) {   /* read next */
        LIST_REMOVE(marker, inp_list);                           /* unlink    */
        LIST_INSERT_AFTER(inp, marker, inp_list);                /* relink    */
        ... inp->inp_flags / prison_xinpcb(inp) / bcopy(inp, ...) ...

(in_pcb.c:2458-2471). The marker only keeps the walk coherent when SYSCTL_OUT() blocks (that is what it was designed for); it does not make the advance atomic against a same-cpu netisr that concurrently removes and frees the pcb being stepped to (rip_detach → in_pcbdetach → in_pcbofflist + kfree(inp) — the free happens in the same dispatch, in_pcb.c:1210-1226). The twin walker tcp_pcblist() (tcp_subr.c:1226-1300) has the identical dance and admits the assumption in its own comment: "but otherwise depend on being on the correct cpu to avoid races" — correct-cpu placement is sufficient for code running in netisr context, but the sysctl walker is a user thread merely migrated onto that cpu (lwkt_migratecpu, in_pcb.c:2450).

If a pcb removal lands between the LIST_NEXT read and the LIST_INSERT_AFTER, the marker is relinked relative to an unlinked and freed inpcb: LIST_INSERT_AFTER writes the marker pointer into freed M_PCB memory, leaves succ->le_prev pointing into the freed chunk, and the walk then reads freed (possibly recycled) memory (inp->inp_flags, prison_xinpcb derefs inp->inp_socket->so_cred, bcopy(inp,...) exports recycled heap contents to the reader).

Reachability

• Reader half: any unprivileged user — sysctl net.inet.raw.pcblist (CTLFLAG_RD, no privilege gate).
• Churn half: raw-socket create/close requires root (raw_ip.c:473 SYSCAP_NONET_RAW) — or an unprivileged user via the setuid-root /sbin/ping (-r-sr-xr-x on the stock guest): each invocation creates and closes an ICMP raw socket, so an unpriv user can drive ripcb churn at will.

Reproduce

scp pcb_race.c build.sh run.sh dfbsd:/tmp/df3315/
ssh dfbsd  'cd /tmp/df3315 && sh build.sh'
ssh dfbsd  'cd /tmp/df3315 && ./pcb_race -c 300 96 &'      # root churner
ssh dfbsd-maxx '/tmp/df3315/pcb_race -r 280'               # unpriv reader
# (or sh run.sh 280 — runs both; see VERDICT.md for the multi-reader runs)

Expected on success: kernel panic (LIST corruption / wild deref in prison_xinpcb/sotoxsocket/in_pcbofflist KASSERT) or garbage (recycled-heap) records among the dumped xinpcb entries.

Result on this guest

NOT reproduced under maximal stress: ~13.8M sysctl dumps (~6x10^9 marker advances) against ~7M concurrent pcb teardowns across three rounds (115 s single reader @45k dumps/s; 230 s x 8 concurrent readers @6.5k dumps/s each; churn 13-55k cycles/s). No panic, no corruption, guest healthy. See VERDICT.md for why: on this kernel the teardown work in netisr0 executes at the walker's blocking/yield points (where the marker protocol protects the walk), not by preempting the walker mid-dance.

Fix

fix.diff — wrap the marker advance plus the pcb snapshot in crit_enter()/crit_exit() so the sequence is atomic against same-cpu netisr preemption regardless of pcbinfo sharing. The same treatment is needed for the tcp_pcblist() twin in tcp_subr.c (out of this diff's scope).

DF-3315 VERDICT — not_reproduced (structural race confirmed, practical trigger not achieved)

Status: not_reproduced. Impact observed: none (guest survived all runs). Structural claim: confirmed by source analysis — the race exists by construction; whether it can be entered depends on lwkt scheduler preemption semantics that, empirically, do not preempt the walker mid-dance in this workload.

Source-level proof of the missing synchronization

1. ripcbinfo is initialized non-shared: raw_ip.c:115 in_pcbinfo_init(&ripcbinfo, 0, FALSE) → infotoken == NULL (in_pcb.c:201-207).
2. GET_PCBINFO_TOKEN() is a no-op when infotoken == NULL (in_pcb.h:439-443) → in_pcblist_range (in_pcb.c:2452) holds nothing while walking ripcbinfo.pcblisthead.
3. The marker advance is three separate operations with no atomicity: read-next (in_pcb.c:2458), unlink (2459), relink-after (2460).
4. The mutator, in_pcbofflist() (in_pcb.c:255-270), runs from rip_detach in netisr0 and frees the inpcb in the same dispatch via in_pcbdetach (in_pcb.c:1210-1226, kfree(inp, M_PCB) at 1225).
5. The walker is a user thread (sysctl) only migrated onto the pcbinfo cpu (in_pcb.c:2450 lwkt_migratecpu); tcp_pcblist's own comment (tcp_subr.c:1246-1249) states the design assumption: "depend on being on the correct cpu to avoid races" — which is only sound for code running inside the netisr, not for a preemptible user thread parked on it.
6. If a teardown lands in the window, LIST_INSERT_AFTER(inp, marker) relinks the marker after an unlinked+freed pcb: marker pointer written into freed M_PCB memory; succ->le_prev points into the freed chunk; subsequent reads (inp->inp_flags 2462, prison_xinpcb 2464 → in_pcb.c:2392-2406 derefs inp->inp_socket->so_cred, bcopy 2469) operate on freed/recycled memory and export recycled heap contents to the unprivileged reader.

Attempts (all on DragonFly 6.5-DEVELOPMENT #0, INVARIANTS kernel, 6 cpus)

Cumulative: ~13.8M sysctl dumps, ~6x10^9 marker-dance windows, ~7M pcb teardowns. Zero faults; no garbage observed in dumped records (all records were well-formed xinpcb entries of live raw sockets + the expected zero-padding tail).

Why it does not fire (analysis)

The teardown work (rip_detach messages) executes in the netisr0 thread; in this workload it is processed while the walker is blocked or yielding — SYSCTL_OUT copyout (1.1 GB/s across the readers) provides constant blocking points, and at those points the marker is linked and the protocol works exactly as designed (removal of the element before the marker correctly re-links the marker; in_pcb.c:1316-1331 comment). The lwkt scheduler did not preempt the walker user thread inside the ~15 ns advance window often enough (or at all) to intersect one of the ~260/s removals of the exact element being stepped to. The safety therefore rests on scheduler serialization behavior, not on any synchronization in the code — a fragility (any future preemption change, or a pcb teardown that runs in true interrupt context, re-opens the window), which is why this is filed as a hardening (Low/speculative) finding rather than a demonstrable DoS.

Exploit chain (if it ever fired)

unpriv sysctl net.inet.raw.pcblist loop + unpriv setuid-ping churn loop → marker relinked after freed inpcb → UAF write (pointer into freed M_PCB chunk) + UAF read (recycled heap contents exported to user) → list corruption → panic; recycled-chunk contents could in principle include other pcbs' data (info leak). Not demonstrated.

Fix validation

not_testable — the baseline never reproduced the fault, so "patched kernel no longer faults" is vacuous. fix.diff (crit_enter/crit_exit around advance+snapshot) applies cleanly to sys/netinet/in_pcb.c (patch -p1 --dry-run verified) and is defense-in-depth making the walk atomic by construction instead of by scheduler behavior. The identical dance in tcp_subr.c tcp_pcblist() (fully unprivileged churn — TCP connect/close storm) needs the same treatment; recommend fixing both.

Known-findings fix status checked during this pass

• DF-0333 (xinpcb pointer leak): unfixed — in_pcb.c:2469 still bcopys the raw inpcb; sotoxsocket (uipc_socket2.c:827) additionally exports xso_so = so and xso_pcb = so->so_pcb raw pointers (same sysctl/sink, same fix scope as DF-0333).
• DF-0334 (div0): unfixed — in_pcb.c:428 cut % lport and in_pcb.c:885 karc4random() % count both intact.
• DF-0335 (portrange inversion): unfixed — in_pcb.c:2532-2555 intact.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.