tuncreate() error path publishes a half-built softc via dev->si_drv1 (no rollback on if_alloc failure) — poisoned device node leads to later NULL-deref panic
Summary
tuncreate() sets dev->si_drv1 = sc and reference_dev() before if_alloc(); when if_alloc() fails it returns NULL without freeing sc, unlinking si_drv1, or dropping the dev reference. tunopen() returns ENOMEM - but the cdev node keeps si_drv1 pointing at a softc whose tun_ifp is NULL. Every subsequent open() takes the sc != NULL path, skips tuncreate, sets TUN_OPEN and SUCCEEDS; the next tunioctl/tunread/tunwrite dereferences sc->tun_ifp == NULL (tunioctl :671 then :679 'ifp->if_type') - kernel NULL-pointer panic with a permanently poisoned /dev/tunN. Requires one if_alloc() failure (memory pressure) during root-driven creation. Code-path proof. Fix: roll back on failure + re-check tun_ifp in open. [VERIFIED pass2: trigger unreachable - if_alloc IFT_PPP is plain M_WAITOK with no failure path; mechanism line-certain; rollback fix authored]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3409 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 930 B | ↓ raw | |
| VERDICT.md | — | 2.1 KB | ↓ raw | |
| manifest.json | — | 686 B | view raw | |
| verdict.json | — | 1.6 KB | view raw |
DF-3409 -- verification pack
Method: Code-line analysis + attempted live reproduction Status: NOT REPRODUCED | impact: none | confidence: certain
What this is
tuncreate publishes dev->si_drv1 = sc BEFORE if_alloc and never rolls back on failure (if_tun.c:213-242) - the half-built softc would later NULL-deref in tunifioctl (sc->tun_ifp == NULL). However the trigger is unreachable in practice: if_alloc(IFT_PPP) is a plain M_WAITOK kmalloc with no com_alloc hook (if.c if_alloc), so it cannot fail short of a sleeping allocation failure the kernel does not surface. Mechanism line-confirmed; no live/harness trigger.
Build
cc -O -o <prog> <prog>.c (on the guest)
Run
(none)
(success criterion: see VERDICT.md)
Evidence
VERDICT.md: if_alloc excerpt (M_WAITOK, IFT_PPP has no com_alloc) - failure path unreachable
Kernel references: sys/net/tun/if_tun.c:213-242, sys/net/if.c:if_alloc
DF-3409 -- VERDICT
NOT REPRODUCED (impact=none, confidence=certain) Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Summary
tuncreate publishes dev->si_drv1 = sc BEFORE if_alloc and never rolls back on failure (if_tun.c:213-242) - the half-built softc would later NULL-deref in tunifioctl (sc->tun_ifp == NULL). However the trigger is unreachable in practice: if_alloc(IFT_PPP) is a plain M_WAITOK kmalloc with no com_alloc hook (if.c if_alloc), so it cannot fail short of a sleeping allocation failure the kernel does not surface. Mechanism line-confirmed; no live/harness trigger.
How it was verified
- Method: Code-line analysis + attempted live reproduction
- Kernel references: sys/net/tun/if_tun.c:213-242, sys/net/if.c:if_alloc
- Evidence: VERDICT.md: if_alloc excerpt (M_WAITOK, IFT_PPP has no com_alloc) - failure path unreachable
- Reachability: local-unpriv where noted in the summary; root-config for tun/lagg/carp/ipfw3/gre items; remote-facing for the packet parsers (wlan harnesses model the RX/TX path verbatim because the guest has no 802.11 hardware; precedent DF-0393/DF-0594/DF-0621/DF-0350).
- Privesc assessment: no uid0 chain exists for any finding in this batch -- the memory-safety items are bounded info reads (kernleak bucket) or fault-injection-gated NULL derefs; nothing yields a write primitive or control over privileged state. The one panic-class live item (DF-3414) is root-only (SIOCIFDESTROY).
Fix
fix_status: not_testable -- Fix: on if_alloc failure, kfree(sc) and clear dev->si_drv1 before returning NULL; trigger unreachable, no A/B possible.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
(No fix.diff for this item: documented recommendation only - see Fix above.)
Fix verification
not_testableFix: on if_alloc failure, kfree(sc) and clear dev->si_drv1 before returning NULL; trigger unreachable, no A/B possible.
Confirmed kernel references
- sys/net/tun/if_tun.c:213-242
- sys/net/if.c:if_alloc
Detail
Evidence (decisive lines)
VERDICT.md: if_alloc excerpt (M_WAITOK, IFT_PPP has no com_alloc) - failure path unreachable
Verdict
tuncreate publishes dev->si_drv1 = sc BEFORE if_alloc and never rolls back on failure (if_tun.c:213-242) - the half-built softc would later NULL-deref in tunifioctl (sc->tun_ifp == NULL). However the trigger is unreachable in practice: if_alloc(IFT_PPP) is a plain M_WAITOK kmalloc with no com_alloc hook (if.c if_alloc), so it cannot fail short of a sleeping allocation failure the kernel does not surface. Mechanism line-confirmed; no live/harness trigger.
No comments yet.