DF-3387 — lagg_input() NULL-mbuf reinput panic (cross-file: sys/net/lagg/if_lagg.c via ether_reinput_oncpu contract)

Summary

lagg_input() (sys/net/lagg/if_lagg.c:1462-1471) frees the received mbuf and sets m = NULL when the lagg master interface is in IFF_MONITOR mode — then falls through and calls ether_reinput_oncpu(scifp, NULL, REINPUT_RUNBPF) inside the if (m != NULL) block. ether_reinput_oncpu() (sys/net/if_ethersubr.c:1303-1333) has no NULL check; with the lagg master IFF_UP it dereferences m->m_pkthdr.rcvif (write of ifp to fixed offset 0xa0 of a NULL mbuf) → Fatal trap 12, page fault at vaddr 0xa0.

Deterministic on the FIRST packet received on any slave of an IFF_UP|IFF_MONITOR lagg. Setup is privileged (ifconfig lagg0 create, laggproto failover, laggport <slave>, ifconfig lagg0 up monitor); the trigger is ordinary received traffic — broadcast noise on any slave is enough, so once configured the panic is remotely triggerable by any host on the network.

Reproduce (on the DragonFly guest)

# build
cc -O -g -Wall -o /root/df3387_trigger trigger.c

# run (root)
/root/df3387_trigger

Expected (baseline, stock kernel)

Serial console / vm.sh log:

[df3387] + ifconfig lagg0 up monitor -> rc=0
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address   = 0xa0
fault code      = supervisor write data, page not present
current process     = Idle
kernel: type 12 trap, code=2
Stopped at      ether_reinput_oncpu+0x1a:       movq    %rdi,0xa0(%rsi)
db>

0xa0(%rsi) with rsi == NULL is exactly m->m_pkthdr.rcvif = ifp; (if_ethersubr.c:1320) — write-only to a fixed near-NULL address, i.e. a clean panic, not controllable corruption.

Fixed (fix.diff applied, rebuilt kernel)

Trigger runs to completion: all eight steps succeed, the injected frame is discarded by the monitor path, the program prints NO PANIC — bug did not reproduce, destroys lagg0/tap0 and exits 2. Guest stays up.

Files

• trigger.c — setup + RX injection (write(2) to /dev/tapN is an RX inject: tapwrite() → ifp->if_input(ifp, top, NULL, -1) → ether_input)
• build.sh, run.sh — exact commands
• build.log — compile output (also kernel-build tail for the fix run)
• run.log, run.2.log — baseline runs (panic)
• run.patched.log — fix-validation run (no panic)
• panic.txt, panic.2.txt — full serial-console panics (baseline + 2nd run)
• env.txt — guest identity
• fix.diff — git-apply-able two-hunk fix (if_lagg.c primary, if_ethersubr.c defensive)
• manifest.json, verdict.json

DF-3387 — VERDICT

Status: reproduced — deterministic kernel NULL-deref panic, exact predicted instruction. Impact: dos (panic) — write-only fault at fixed vaddr 0xa0, no controllable primitive. Fix: validated (fixed) — patched kernel boots, same PoC harmlessly discards the frame, guest stays up.

Root cause (line-accurate)

sys/net/lagg/if_lagg.c:1462-1471:

    if (m != NULL) {
        IFNET_STAT_INC(ifp, ipackets, 1);
        IFNET_STAT_INC(ifp, ibytes, m->m_pkthdr.len);

        if (scifp->if_flags & IFF_MONITOR) {
            m_freem(m);
            m = NULL;                       /* <-- m consumed   */
        }
        ether_reinput_oncpu(scifp, m, REINPUT_RUNBPF);   /* <-- NULL passed  */
    }

sys/net/if_ethersubr.c:1303-1321 (ether_reinput_oncpu) accepts no NULL — first deref with the lagg master IFF_UP:

    if ((reinput_flags & REINPUT_KEEPRCVIF) == 0 ||
        m->m_pkthdr.rcvif == NULL)          /* m == NULL -> fault at 0xa0 */
    {
        m->m_pkthdr.rcvif = ifp;

Attack chain (all reproduced on the guest):

1. ifconfig tap0 create && ifconfig tap0 up
2. ifconfig lagg0 create && ifconfig lagg0 laggproto failover && ifconfig lagg0 laggport tap0 — enslaving sets the slave's if_type = IFT_IEEE8023ADLAG (if_lagg.c:674), which routes its RX to the lagg branch of ether_demux_oncpu (if_ethersubr.c:1076) — before any L3 processing, so frame content beyond the 14-byte header is irrelevant.
3. ifconfig lagg0 up monitor — master gets IFF_UP|IFF_MONITOR.
4. One frame received on tap0. write(2) to /dev/tap0 is an RX injection: tapwrite() (sys/net/tap/if_tap.c) ends in ifp->if_input(ifp, top, NULL, -1) → ether_input → ether_input_handler → ether_input_oncpu → ether_demux_oncpu → lagg_input → failover input returns the mbuf (tap0 is primary) → IFF_MONITOR branch NULLs it → ether_reinput_oncpu(scifp, NULL, ...).
5. Fatal trap 12, fault vaddr 0xa0, stopped at ether_reinput_oncpu+0x1a: movq %rdi,0xa0(%rsi) — m == NULL (rsi), the write of ifp to m->m_pkthdr.rcvif.

Runs: 2/2 identical panics (run.log/run.2.log, panic.txt/panic.2.txt). The ssh-side write() return line is lost both times because the panic freezes the guest before sshd flushes; the serial-console mirror ([df3387] ... up monitor -> rc=0) pins the sequence — the only action the program takes after that line is open("/dev/tap0") + write(fd, frame, 34).

Threat model

• Setup is privileged (ifconfig). After setup, the trigger is any received frame on any slave — ambient broadcast traffic suffices; a remote attacker on the L2 segment panics the box with a single packet.
• The faulting instruction writes ifp to fixed address 0xa0 — not attacker-controlled, page 0 unmapped → clean DoS panic, no escalation path.

Why pass-1 missed it / where it sits

This is a callsite violation of the ether_reinput_oncpu contract documented in the audited file (if_ethersubr.c:1303). The other four reinput callers (vlan if_vlan.c:630, carp ip_carp.c:1231/1253, bridge if_bridge.c:2880/2987) all pass non-NULL mbufs — lagg is the outlier. DF-0367 covers a different bug in lagg_input (unlocked ifp->if_lagg deref, lines 1442-1456); the NULL reinput at 1466-1470 is distinct and was unfiled.

Fix validation

fix.diff (two hunks: primary return in if_lagg.c after monitor-discard; defensive NULL guard at the top of ether_reinput_oncpu):

• Baseline (stock #0 kernel): panic as above — reproduced before patching.
• Patched: applied in-guest to /usr/src, make -j8 nativekernel KERNCONF=X86_64_GENERIC + make installkernel, rebooted into #1 kernel. Same PoC: all 8 steps rc=0, frame discarded by the monitor path, NO PANIC — bug did not reproduce, interfaces cleanly destroyed, guest stays up (vm.sh status = up, ssh alive). See run.patched.log + build.log.
• Guest then reset to the clean snapshot (vm.sh reset with-src).

Notes

• ether_reinput_oncpu's only other NULL hazard (m_freem(NULL) on a !IFF_UP interface) is harmless — m_freem() is while (m)-guarded (sys/kern/uipc_mbuf.c:1469). The deref at :1318-1320 is the crash.
• Could an unprivileged user reach this without root setup? No — SIOCSLAGG and SIOCSIFFLAGS are privileged; the finding is privileged-config + remote/unprivileged-trigger, same profile as DF-0445 (Medium).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.