DF-3334 — netmap_mem_get_info() failure paths unbalance the adapter refcount

Target: sys/net/netmap/netmap.c:1331-1333 (NIOCGINFO, reference LEAK) and sys/net/netmap/netmap.c:1398-1402 (NIOCREGIF, premature netmap_adapter_put → refcount underflow → UAF).

NIOCREGIF (the dangerous one)

netmap_get_na() (netmap.c:1377) acquires a reference that netmap_do_regif() then takes ownership of (priv->np_na = na, netmap.c:1209; the dtor drops it once at netmap.c:657). If netmap_mem_get_info() fails right after a successful registration, the error path calls netmap_adapter_put(na) again — one drop too many. On fd close, netmap_dtor() drops it a second time → refcount hits 0 while WNA(ifp) still points at the adapter → use-after-free for the whole interface (next NIOCGINFO/NIOCREGIF/ifunit traffic on that ifp derefs freed memory; driver detach double-frees).

NIOCGINFO (the leak)

Mirror image: on the same netmap_mem_get_info() failure after a successful netmap_get_na(create=1), the code breaks without any netmap_adapter_put(na) → one pinned reference per call (and each call with a fresh interface name attaches a new generic adapter whose if_input hook can then never be removed).

Trigger gating (why Low/likely)

netmap_mem_get_info() (netmap_mem2.c:198-219) fails when nmd->config(nmd) returns nonzero — netmap_mem_global_config() (netmap_mem2.c:798-828) returns a sticky nmd->lasterr that is set by any earlier failed netmap_config_obj_allocator() / netmap_finalize_obj_allocator() (ENOMEM under memory pressure), or directly by root via the RW sysctls dev.netmap.{if,ring,buf}_{size,num} (netmap_mem2.c:146-159). Unprivileged reachability therefore needs a prior allocator failure (plausible under memory pressure, not deterministic); with the sysctl it is trivially root-triggered. Additionally, on current DragonFly the whole netmap subsystem does not compile (see DF-3332/env.txt), so the bug is latent until the subsystem is resurrected.

Verification

Phase V skipped (Low severity, latent trigger, subsystem does not build on this tree — see verdict.json). Analysis is line-verified: references are balanced on every other error path of both ioctls (checked line-by-line in VERDICT.md).

DF-3334 — VERDICT (analysis-verified; no runtime PoC — see status)

Reference accounting (traced line-by-line)

Success path NIOCREGIF: netmap_get_na() → +1 (netmap.c:1085 via netmap_get_hw_na/attach), ownership transferred to priv->np_na inside netmap_do_regif() (netmap.c:1209); dtor drops it once (netmap.c:656-659). Balanced.

Error paths of NIOCREGIF: * netmap_get_na fails (netmap.c:1378-1379): nothing held → break. OK. * nifp == NULL (netmap.c:1387-1391): netmap_do_regif cleared priv->np_na on its own error-out (netmap.c:1251), so the caller's netmap_adapter_put(na) drops the one-and-only ref. OK. * netmap_mem_get_info() fails (netmap.c:1398-1402): registration SUCCEEDED (priv->np_na == na, np_nifp set, active_fds incremented, adapter in netmap mode) — but the path still does netmap_adapter_put(na). That reference is not the caller's to drop anymore. One drop too many ⇒ at fd close netmap_dtor() drops again ⇒ refcount 0 while WNA(ifp) still points at the adapter (netmap_detach_common cleared WNA only inside that first free, netmap.c:1867-1868 — wait: the first premature release frees the adapter via netmap_adapter_put → netmap_detach_common → WNA cleared there; the dtor's second put then decrements freed memory (refcount UAF) and any concurrent NA(ifp) user between the two releases is a plain use-after-free). ⇒ UAF, class memcorrupt, trigger-gated.

Error paths of NIOCGINFO: * netmap_get_na fails: break. OK. * netmap_mem_get_info() fails (netmap.c:1331-1333): break without netmap_adapter_put(na) ⇒ leaked reference per call; with create=1 each new nr_name attaches a generic adapter that is pinned forever (if_input interception never removed). Resource-exhaustion DoS, same gating.

Why no runtime PoC

1. The netmap subsystem does not compile on this DragonFly tree (if_unused7 bit-rot — DF-3332/env.txt); no ioctl path exists at runtime.
2. Even on a compiling system, forcing netmap_mem_get_info() to fail requires a sticky allocator error (nmd->lasterr != 0, netmap_mem2.c:826/692) — root-writable sysctl dev.netmap.buf_size (netmap_mem2.c:148) or genuine ENOMEM during a previous finalize (netmap_mem2.c:671). Not deterministically unprivileged-triggerable, hence Low severity and skipped Phase V.

Fix

fix.diff (two hunks): NIOCREGIF must not drop the reference it no longer owns; NIOCGINFO must drop it on failure. Both restore exact balance on every path.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.