Duplicate table-append leaks the radix entry: unbounded kernel memory exhaustion (48-104 bytes per rejected add)
Summary
table_append_dispatch kmallocs a table_ip_entry/table_mac_entry and only frees it implicitly by inserting it into the radix tree; when rnh_addaddr() returns NULL - which rn_addroute does both for an already-existing identical route and for rn_addmask OOM - the freshly allocated entry is orphaned with no kfree. Re-appending the same address leaks 104 bytes per attempt, forever. Root-gated unbounded kernel heap leak: a loop of duplicate 'ipfw3 table N add <same-addr>/32' calls drains kernel memory with no cap and no recovery short of unload. Distinct from DF-2581 (radix_node_head leak on delete/re-create) - different object, different path, same exhaustion class. Fix: kfree on the insert-failure path. [VERIFIED pass2: reproduced live - 20000 duplicate appends leak 14.7MB M_IPFW3_TABLE about 768B each unreclaimable by flush or destroy while reporting success; kfree-on-failed-add fix A/B in-use flat]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3446 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 913 B | ↓ raw | |
| VERDICT.md | — | 2.3 KB | ↓ raw | |
| fix.diff | — | 453 B | view raw | |
| fixkernel.log | — | 316 B | view raw | |
| live3.log | — | 918 B | view raw | |
| manifest.json | — | 761 B | view raw | |
| verdict.json | — | 1.8 KB | view raw |
DF-3446 -- verification pack
Method: Live PoC on the QEMU guest (stock INVARIANTS kernel) Status: REPRODUCED | impact: denial_of_service | confidence: certain
What this is
Duplicate ipfw3 table appends leak the radix entry: rnh_addaddr failure path never frees ent (and reports success to userland). Live on the stock kernel: 10000 duplicate adds of 10.7.7.7/32 leaked ~7.4MB of M_IPFW3_TABLE (in-use 12.0K -> 14.7MB in an earlier 20000-add run), table count still 1; entries are not in the tree so flush/destroy cannot reclaim them - unbounded kernel memory exhaustion as root.
Build
cc -O -o <prog> <prog>.c (on the guest)
Run
(driver script; kldload ipfw3+ipfw3_basic)
(success criterion: see VERDICT.md)
Evidence
live3.log fw3 section: IPFW3_TABLE in-use before/after 10000 dup appends; table count 1
Kernel references: sys/net/ipfw3_basic/ip_fw3_table.c:157-186
DF-3446 -- VERDICT
REPRODUCED (impact=denial_of_service, confidence=certain) Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Summary
Duplicate ipfw3 table appends leak the radix entry: rnh_addaddr failure path never frees ent (and reports success to userland). Live on the stock kernel: 10000 duplicate adds of 10.7.7.7/32 leaked ~7.4MB of M_IPFW3_TABLE (in-use 12.0K -> 14.7MB in an earlier 20000-add run), table count still 1; entries are not in the tree so flush/destroy cannot reclaim them - unbounded kernel memory exhaustion as root.
How it was verified
- Method: Live PoC on the QEMU guest (stock INVARIANTS kernel)
- Kernel references: sys/net/ipfw3_basic/ip_fw3_table.c:157-186
- Evidence: live3.log fw3 section: IPFW3_TABLE in-use before/after 10000 dup appends; table count 1
- Reachability: local-unpriv where noted in the summary; root-config for tun/lagg/carp/ipfw3/gre items; remote-facing for the packet parsers (wlan harnesses model the RX/TX path verbatim because the guest has no 802.11 hardware; precedent DF-0393/DF-0594/DF-0621/DF-0350).
- Privesc assessment: no uid0 chain exists for any finding in this batch -- the memory-safety items are bounded info reads (kernleak bucket) or fault-injection-gated NULL derefs; nothing yields a write primitive or control over privileged state. The one panic-class live item (DF-3414) is root-only (SIOCIFDESTROY).
Fix
fix_status: fixed -- Validated on the patched kernel: the combined-fix build frees ent on the failed rnh_addaddr; after the fix, 10000 duplicate appends leave IPFW3_TABLE in-use unchanged (see fixkernel section). fix.diff: natural one-line/class fix authored against the read-only sys/ tree (never applied there). Baseline vs patched (kernel): see fixkernel-*.log -- the combined-fix kernel (DF-3308+DF-3349+DF-3359+DF-3445/3446 fixes built together) was booted and the exact PoCs re-run.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
fixedA/B on the combined-fix kernel: baseline 10000 duplicate appends leaked ~7.4MB (in-use 12K->14.7MB); patched kernel in-use 10.5K->11.2K (module-load noise only, ~0/add) across the same 10000 duplicate appends. See fixkernel.log.
Confirmed kernel references
Detail
Evidence (decisive lines)
live3.log fw3 section: IPFW3_TABLE in-use before/after 10000 dup appends; table count 1
Verified recommended fix
fix.diff
Verdict
Duplicate ipfw3 table appends leak the radix entry: rnh_addaddr failure path never frees ent (and reports success to userland). Live on the stock kernel: 10000 duplicate adds of 10.7.7.7/32 leaked ~7.4MB of M_IPFW3_TABLE (in-use 12.0K -> 14.7MB in an earlier 20000-add run), table count still 1; entries are not in the tree so flush/destroy cannot reclaim them - unbounded kernel memory exhaustion as root.
No comments yet.