DF-3426 — netmap generic TX pool mbuf UAF / double-free (VERIFIED)

What this is

The production netmap KLD (verbatim sys/net/netmap/ sources) rebuilt in a copied tree with two infrastructure port shims (the stock module does not compile on this tree), loaded on the stock 6.5-DEVELOPMENT INVARIANTS guest, and driven through the real /dev/netmap userspace ABI.

The two port shims (no logic under audit is touched): - wna_shim.[ch] — pointer-sized WNA side table (this tree's struct ifnet has no if_unused7; netmap_kern.h:747) - rig_port2.patch — dev_open_args.a_fp → *a_fpp (netmap_freebsd.c:387) - rig_trace.patch — RIG_TRACE kprintf diagnostics only

Build (guest, as root, files scp'd to /root/df3426)

./build.sh                 # -> netmap-src/netmap.ko + ./trigger

Run (guest, as root)

./run.sh probe             # sanity: register/unregister, counters flat
./run.sh unreg 8           # 8 double frees, counter-exact, guest ALIVE
./run.sh uaf 512 4096 16384  # UAF reuse -> Fatal trap 12 panic
./run.sh evt               # ring exhaustion + unregister -> 2^64-767

Prerequisite state (run.sh sets it up): kldload if_tap; ifconfig tap0 create && ifconfig tap0 up; kldload ./netmap-src/netmap.ko. tap0 has no reader, so tapifstart()->ifsq_purge() frees every dispatched mbuf synchronously inside ifq_dispatch() — a deterministic stand-in for driver TX completion.

Expected output

• unreg 8: rc=0; netstat -m "mbuf clusters in use" drops 256 → 248 (exactly −8 = the 8 double frees). Guest stays up.
• uaf 512 4096 16384: kernel prints both RIG: txsync enter: laps, then RIG: ring exhausted, RIG: generic_set_tx_event, RIG: generic_mbuf_destructor CALLED, then "Fatal trap 12: page fault while in kernel mode" and the guest dies in DDB (run.log / panic_uaf_run2_serial.txt).
• evt: rc=0 but netstat -m shows 18446744073709550849/33552 mbuf clusters in use (counter underflow).

Fix validation (fix.diff)

cd netmap-src && patch < ../fix3426-rig.diff && make   # fixed module
# then re-run the exact same PoC matrix -> no panic, counters flat,
# set_tx_event arms on NULL (mbuf=0) and returns early

See fix_validation.log / fix_validation27.log, VERDICT.md.

Verdict

reproduced (impact: panic — kernel memory corruption gated on root/wheel for /dev/netmap access, as filed). Full narrative: VERDICT.md.

DF-3426 — netmap generic TX pool mbuf UAF / double-free — VERIFIED

status: reproduced | reproduced: 1 | impact: panic (kernel memory corruption) | confidence: certain

The finding was previously closed build_failed (the stock netmap KLD does not compile on this tree). This run made the production module buildable in a copied tree with two infrastructure-only port shims (pointer-sized WNA side table + dev_open_args.a_fpp), loaded it into the stock 6.5-DEVELOPMENT INVARIANTS guest, and drove the real /dev/netmap ABI (NIOCREGIF/NIOCTXSYNC on a tap(4) port with no reader, so tapifstart()->ifsq_purge() "completes" TX — i.e. frees the mbuf — synchronously inside ifq_dispatch()).

What was demonstrated (unfixed production code)

1. Double free, counter-exact, on a live guest (unreg 8): 8 packets dispatched (each mbuf freed by tap purge inside ifq_dispatch), then close() → generic_netmap_register(0) m_freem()s every pool entry (netmap_generic.c:275-280) → the 8 dispatched slots freed a second time. netstat -m: mbuf clusters in use 256 → 248 (exactly −8). No legitimate path decrements without an allocation. (unreg_accounting.txt)

2. Ring reuse UAF + kernel page fault panic (uaf 512 4096 16384): lap 1 dispatches 512 pool mbufs (all freed synchronously); a 4096-datagram UDP spray to 127.0.0.1 reallocates the freed combined mbuf+cluster objects as live network mbufs through the objcache magazine fast path; lap 2 rewinds ring->cur so generic_netmap_txsync() walks over the dangling tx_pool[0..510] (netmap_generic.c:504) and generic_xmit_frame() (netmap_freebsd.c:124-138) writes m_len=0, 64 attacker-supplied bytes via m_copyback2, rcvif/hash, then hands the stolen live mbuf to ifq_dispatch() a second time. At ring exhaustion generic_set_tx_event (netmap_generic.c:421-445) arms SET_MBUF_DESTRUCTOR on a freed pool entry and m_freem()s it. Result: Fatal trap 12, page fault in kernel mode, guest dead in DDB (run.log / panic_uaf_run2_serial.txt; reproduced twice).

3. Mass double free at unregister (evt): full lap + close → netstat -m in-use counter underflows to 18446744073709550849 (= 2^64 − 767; net drift −1023) with 128289406846% of mb_map "in use" — the mbuf accounting system itself testifies to ~1024 double frees. (run_evt.log)

Gating (unchanged from the filing)

/dev/netmap is 0660 root:wheel (netmap.c:2237); the guest's unprivileged user maxx is not in wheel. The corruption is therefore reachable by root/wheel (or any service granted the fd), not by an unprivileged user; severity stays High for kernel memory corruption, consistent with the filing. From the permitted context the primitive is: (a) a double objcache_put (two-owner mbuf) and (b) a repeatable attacker-sized write into recycled mbuf headers/clusters — standard mbuf-forgery escalation material; a full uid=0 chain from uid!=0 is not applicable through this device node.

Fix validation (fix.diff = clear tx_pool[j] after dispatch)

Baseline (above) vs patched module, identical PoC matrix (fix_validation.log):

Trace under the fix: generic_set_tx_event e=… mbuf=0 → NULL-check early return (no destructor install, no m_freem of driver-owned memory); replenish paths (:361, :505-512) refill the NULL slots. fix.diff applies cleanly to the pristine sys/net/netmap/netmap_generic.c (patch -p4 --dry-run OK). fix_status: fixed.

Rig faithfulness

The module is the verbatim production source; only two port shims (WNA storage location; cdevpriv arg) and RIG_TRACE kprintfs were added — none touch the TX-pool lifetime logic under audit (see build.sh, rig_trace.patch, rig_port2.patch, wna_shim.[ch]). Guest /usr/src and host sys/ tree md5 match on netmap_generic.c (5c1169dfc687831d5ceb0c973d78d53a).

Environment

DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC (INVARIANTS), cc 8.3 [DragonFly], see env.txt.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.