DF-3457 — gif(4) destroy races in-flight gif_output (UAF -> panic)

Repro: unprivileged user floods traffic through a root-configured gif0 tunnel while root churns ifconfig gif0 destroy/create. The destroy path frees/NULLs gif_psrc/gif_pdst (and later the whole softc) without holding gif0's ifnet serializer, while gif_output() (in any sender thread) holds that serializer and dereferences the same fields mid-encapsulation.

Files

• flood.c — unprivileged flooder (build: cc -O2 -o flood flood.c; run as non-root: ./flood 6 10.99.0.1)
• churn.sh — root-side create/destroy loop (./churn.sh 300)
• run.log — full decisive run incl. control + panic capture
• panic.txt — kernel panic from the serial console
• fix.diff — validated one-hunk fix (ifnet_serialize_all in gif_clone_destroy)
• env.txt — guest state
• verdict.json / manifest.json — machine records

Exact steps (single-tenant QEMU guest, 6 vCPU, INVARIANTS kernel)

# root setup
ifconfig gif0 create
ifconfig gif0 tunnel 127.0.0.1 127.0.0.99    # blackhole outer dst:
                                             # encapped pkts never echo
ifconfig gif0 10.98.0.1 10.98.0.2 up
route add -net 10.99.0.0/24 -iface gif0

# unprivileged side (maxx)
cc -O2 -o flood flood.c
./flood 6 10.99.0.1        # ~25k pps aggregate (keep netisr0 alive)

# root side
./churn.sh 300             # ~15-20 create/destroy cycles per second

Expected result (vulnerable kernel)

Within ~1-2 minutes:

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x1
Stopped at  gif_output+0x128:  movzbl 0x1(%rax),%eax

(sc->gif_psrc NULLed between if_gif.c:346 guard and :373 deref.)

Expected result (patched kernel, fix.diff applied)

No panic for the full run; guest stays up; flood reports EAFNOSUPPORT=0 throughout.

DF-3457 — gif(4) clone-destroy races in-flight gif_output(): unserialized free/NULL of gif_psrc/gif_pdst (and gif_softc) panics the kernel

VERDICT: REPRODUCED (kernel panic, unprivileged traffic side + root teardown side). fix.diff VALIDATED (patched kernel survives the exact PoC; see below).

ROOT CAUSE (path:line)

Two execution contexts touch gif softc state with NO common lock:

• gif_output() [sys/net/gif/if_gif.c:396-409] runs in ANY thread (an unprivileged user's sendto() to a destination routed via gif0: udp_output -> ip_output -> if_output). It takes the gif's tx-queue hw serializer, ifsq_serialize_hw(), which IS ifp->if_serializer [sys/net/if.c:642, sys/net/ifq_var.h:517-527], and holds it across gif_output_serialized() [if_gif.c:332-394] -> in_gif_output() [sys/netinet/in_gif.c:96-217].

• gif_clone_destroy() [if_gif.c:176-203], reached from SIOCIFDESTROY in the ifconfig syscall thread [sys/net/if.c:2012-2016 -> sys/net/if_clone.c:126-132], takes NO gif serializer at all (unlike the SIOCSIFPHYADDR path, which is correctly wrapped in ifnet_serialize_all() at if.c:2350-2352). It calls gif_delete_tunnel() which immediately kfree(sc->gif_psrc); sc->gif_psrc = NULL; kfree(sc->gif_pdst); sc->gif_pdst = NULL; [if_gif.c:821-828] and later kfree(sc) [if_gif.c:200].

The racing deref sites: * if_gif.c:373 sc->gif_psrc->sa_family -- re-read AFTER the NULL guard at if_gif.c:345-350 (TOCTOU on the guard itself) * in_gif.c:101-102 load sin_src/sin_dst = sc->gif_psrc/gif_pdst, then deref at :107-109 (family), :156-159 (addresses), :183-188 (route-cache compare against freed sockaddrs), and ip_output() at :215 uses/writes &sc->gif_ro[cpuid] inside the softc. * v6 twin: in6_gif.c:102-110, :172-193, :187-201.

REPRODUCTION (see README.md / run.log / panic.txt)

Unprivileged user floods UDP through a root-configured gif0 while root loops ifconfig gif0 destroy/recreate. ~75 s into the race:

Fatal trap 12: page fault while in kernel mode fault virtual address = 0x1 Stopped at gif_output+0x128: movzbl 0x1(%rax),%eax

fault VA 0x1 => %rax == NULL => sc->gif_psrc had been NULLed by gif_delete_tunnel() between the :346 guard and the :373 deref. Other interleavings of the same window read the kfree'd sockaddr (INVARIANTS slab poisons it with 0xdeadc0de, kern_slaballoc.c:191) or the freed softc.

THREAT

Requires a root-configured gif tunnel and a root-side destroy while unprivileged local traffic transits it — the standard dynamic-VPN provisioning churn. The unprivileged user only needs to send packets; the fault occurs in the sender's (or netisr's) context. Impact: reliable kernel panic (local DoS); with heap grooming of the 16-byte M_IFADDR-size zone (any user-triggerable sockaddr kmalloc reuses the freed chunk and fully controls its 16 bytes) the corrupted source/destination read at in_gif.c:156-159 becomes attacker-chosen address injection; the freed softc gives a write-what-into-freed-chunk primitive via ip_output()'s ro->ro_rt store at in_gif.c:215. Full uid=0 escalation not developed: the racing free requires root-side churn, bounding the security value of the primitive.

FIX (fix.diff, validated)

Wrap the softc-state teardown in gif_clone_destroy() in ifnet_serialize_all()/ifnet_deserialize_all() — the same serializer gif_output() holds for the entire encapsulation and the one the SIOCS*PHYADDR ioctl paths already use. Nothing inside the wrapped region takes ifp's serializer, so no recursion/deadlock.

baseline : panic in gif_output+0x128 after ~75 s of racing (panic.txt) patched : identical PoC run for 600 s (2x the baseline time-to-crash and 4x the churn cycle count) — guest up, zero panics, flood EAFNOSUPPORT count 0, churn 8460 cycles (fix_run.log)

NOTES

• The encaptab walk vs encap_detach() race during the same destroy is DF-3425 (known, filed against if_gif.c in pass 1) and is NOT re-reported here; this finding is the output-path half of the same missing-serialization root cause, with its own deref sites and its own reproduced panic signature.
• The SIOCSIFPHYADDR/SIOCDIFPHYADDR ioctl path is correctly serialized (if.c:2350) — verified by inspection; the destroy path simply forgot the same discipline.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.