DF-3372 — sockaddr fields read before sa_len validation in TCP bind/connect

What

tcp_usr_bind (sys/netinet/tcp_usrreq.c:316-321), tcp_usr_connect (:597-602), tcp_usr_preconnect (:965-968), tcp6_usr_bind (:406-411) and tcp6_usr_connect (:640-656, incl. the prison_remote_ip call) cast the user-supplied sockaddr to sockaddr_in/sockaddr_in6 and read sin_addr (offsets 4..7) / sin6_addr (offsets 8..23) before any length validation. The deep validators (in_pcbbind in_pcb.c:648, in_pcbladdr_find in_pcb.c:954, in6_pcbbind in6_pcb.c:129, in6_pcbladdr in6_pcb.c:282) all check sa_len first — but they run after these pre-checks.

getsockaddr() (sys/kern/uipc_syscalls.c:1513-1532) kmallocs exactly namelen bytes (2..255) and copies only that many user bytes, so:

• v4, namelen 2..4: sin_addr is read entirely beyond the copied data (recycled, uninitialized 8-byte slab chunk contents; zoneindex() maps sizes 2..8 to the 8-byte class).
• v6, namelen 2..23: sin6_addr (offsets 8..23) is read up to 16 bytes past an 8-byte allocation (cross-object read into neighboring slab chunks); prison_remote_ip (kern_jail.c:469-472) reads the same bytes with no length check of its own.

Same defect family as DF-3357 (udp_usrreq.c), where the UDP code used the OOB address as a packet destination. In TCP the bytes only steer the multicast rejection (EAFNOSUPPORT vs the later EINVAL from the length check) — a 1-bit oracle.

PoC

• oob_oracle.c — grooms the M_SONAME 8-byte slab class with a controlled sin_addr via UDP bind(2) (which allocates+frees the same chunk), then binds/connects a TCP socket with a 2-byte sockaddr. Success criterion: errno flips 22 (EINVAL) → 47 (EAFNOSUPPORT) when the groom address is multicast.
• Probes: probe.c-series (probe*.log) sweep groom vectors (bind/sendto, 8/16-byte, 2..256 reps, 48-process fleet).

Result (honest)

The read is certain from the code path and the multicast decision is live (a 5-byte sockaddr whose copied byte 4 = 224 deterministically returns EAFNOSUPPORT; = 8 returns EINVAL — proving the handler consumes sin_addr regardless of sa_len < 16). However the recycled-byte oracle could not be flipped on the stock kernel across ~600k groomed attempts: DF's slab allocator frees cross-CPU chunks to the owning CPU's z_RChunks (kern_slaballoc.c:1491-1547), which a userland-thread allocation never immediately reuses, and the v6 cross-object neighbor byte is structurally the next chunk's sa_len (=8, never 0xff). So: defect real, observable impact on this system: none demonstrated → verdict not_reproduced (reproduced=0, impact=none).

Build / run

cc -O2 -include unistd.h -o oob_oracle oob_oracle.c
./oob_oracle

Fix sketch

Validate length (and family) before touching address fields in each of the five sites, e.g. in tcp_usr_bind/tcp_usr_connect/tcp_usr_preconnect:

if (nam->sa_len < sizeof(struct sockaddr_in))
        return EINVAL;          /* or goto out; as appropriate */

DF-3372 VERDICT — sockaddr read-before-validate in TCP bind/connect paths

Reproduced?

No observable manifestation — not_reproduced (defect itself certain by code path).

What was verified

1. The read is real (by construction). getsockaddr (sys/kern/uipc_syscalls.c:1523) kmallocs exactly namelen bytes (≥2, ≤255) and copies only those; tcp_usr_bind (sys/netinet/tcp_usrreq.c:316-321) / tcp_usr_connect (:597-602) / tcp_usr_preconnect (:965-968) then read sin_family and sin_addr.s_addr (offsets 4..7) before in_pcbbind's sa_len == 16 gate (sys/netinet/in_pcb.c:648). The v6 twins (tcp6_usr_bind :406-411, tcp6_usr_connect :640-656) read sin6_addr (offsets 8..23) — for namelen 8 this is 16 bytes fully past the 8-byte slab chunk — and additionally pass the short buffer to prison_remote_ip (sys/kern/kern_jail.c:469-472), which reads address fields with no length check of its own.

2. The multicast decision consumes sin_addr regardless of sa_len (guest-verified, deterministic): bind with a 5-byte sockaddr (sa_len=5, copied byte 4 = 224) → EAFNOSUPPORT; byte 4 = 8 → EINVAL (see probe2.log / probe_matrix.log). This proves the handler bases its decision on a sockaddr_in whose declared length (5) is smaller than the fields it reads (8 bytes of sin_addr); for namelen ≤ 4 the decision bytes are entirely uncopied.

3. The recycled-byte oracle does not flip on the stock allocator (the honest negative): ~600k groomed attempts (8-byte and 16-byte M_SONAME grooms via UDP bind and sendto, 2..256 reps, single- and 48-process fleets, 200k-iteration hammers — probe.log, probe2.log, probe3.log) produced zero EAFNOSOURCE flips for namelen ≤ 4. Root cause of the resilience: DF's slab allocator puts cross-CPU frees on the owning CPU's z_RChunks remote list (sys/kern/kern_slaballoc.c:1491-1547) which user-thread allocations do not immediately reuse, and the v6 cross-object byte the multicast test samples is the neighbouring chunk's sa_len byte (structurally 8, never 0xff). Affinity pinning (usched_set) is privileged, so the owner-CPU LIFO reuse could not be forced unprivileged.

Impact ceiling

1-bit error-code oracle (EAFNOSUPPORT vs EINVAL) on kernel heap contents beyond the user-copied length, per bind/connect attempt — but not reliably groomable on the stock kernel (see 3). No data leaves the kernel; no write primitive. This is the DF-3357 family with a much lower ceiling because TCP never uses the OOB address (UDP did).

Classification

status=not_reproduced, reproduced=0, impact=none, confidence=certain (that the OOB read occurs), severity Low, CWE-125.

Fix

Validate sa_len (and family) before any field read at the five sites, e.g. tcp_usr_bind:

if (nam->sa_len < sizeof(struct sockaddr_in)) {
        error = EINVAL;
        goto out;
}

mirrored for connect/preconnect (sizeof(sockaddr_in)) and the v6 twins (sizeof(sockaddr_in6)), plus a length guard inside prison_remote_ip callers or in prison_remote_ip itself.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.