DF-3460 — rssadapt sysctl interval handler UAF across vap teardown

File: sys/netproto/802_11/wlan/ieee80211_rssadapt.c Verdict: REPRODUCED (code-level harness; module latent on this guest — see DF-0730 reachability notes). Severity filed: Low (latent) — the amrr twin of this pattern (ieee80211_amrr.c:390-403, plus SYSCTL_ADD_UINT pointing directly into the freed chunk) is the DEFAULT ratectl and would be reachable on any real WiFi system.

What the bug is

Lifetime chain on this tree:

1. vap create → ieee80211_ratectl_init() (ieee80211_ratectl.c:119-135) → rssadapt_init() kmallocs vap->iv_rs AND registers the world-readable sysctl net.wlan.N.rssadapt_rate_interval (rssadapt_sysctlattach, :356-362).
2. vap destroy → every in-tree wifi driver's *_vap_delete() (e.g. if_iwm.c:6486-6493) calls ieee80211_ratectl_deinit(vap) → rssadapt_deinit() (:151-155) → IEEE80211_FREE(vap->iv_rs) — iv_rs is not cleared.
3. Only much later, ieee80211_vap_detach() → … → ieee80211_sysctl_vdetach(vap) (ieee80211.c:827 — the last vdetach, after ether_ifdetach, ieee80211_stop, task drains, node detach) removes the oid.

For the entire window between (2) and (3) the oid stays registered and world-readable, and rssadapt_sysctl_interval() (:340-353) does

struct ieee80211_rssadapt *rs = vap->iv_rs;   /* dangling */
int msecs = ticks_to_msecs(rs->interval);     /* UAF READ  */
... sysctl_handle_int(...)                    /* 4 bytes -> any user */
rssadapt_setinterval(vap, msecs);             /* UAF WRITE (root) */

• Unprivileged read: sysctl net.wlan.N.rssadapt_rate_interval during ifconfig wlanN destroy returns 4 bytes read out of a freed (and typically already-reused — kmalloc size-class reuse is cross-type in DFly) heap chunk → kernel-heap info-leak gadget.
• Root write: sysctl -w in the same window writes 4 controlled bytes into the freed/reused chunk.

Reproduce

./build.sh          # buggy (as shipped)
./run.sh            # → RESULT: BUG REPRODUCED …
./build.sh fixed    # deinit NULLs iv_rs + handler guards
./run.sh            # → RESULT: FIXED — no UAF read/write

(Built -O0: at -O2 gcc CSEs the post-free load with the pre-free one — UB elision the kernel does not perform across the real sysctl dispatch.)

Fix validation

• fix.diff — git apply-clean; patched wlan_rssadapt module builds clean with full kernel -Werror CFLAGS (fix_module_build.log, rc=0).
• Harness fixed mode: handler refuses (ENXIO) during the window; no freed-chunk read or write.

DF-3460 — VERDICT

Status: REPRODUCED (code-level harness, latent module on this guest) Impact: leak (unprivileged 4-byte kernel-heap UAF read via world-readable sysctl during vap teardown; root 4-byte UAF write in the same window) Confidence: certain (teardown order proven from source; harness run on the audit guest)

The window is real — source trace

iwm_vap_delete()                       if_iwm.c:6486-6493
 └─ ieee80211_ratectl_deinit(vap)      ieee80211_ratectl.h:69-72
     └─ rssadapt_deinit(vap)           ieee80211_rssadapt.c:151-155
         └─ IEEE80211_FREE(vap->iv_rs) … iv_rs NOT cleared
 └─ ieee80211_vap_detach(vap)          ieee80211.c:752…
     ├─ ether_ifdetach / ieee80211_stop / draintask / …
     ├─ ieee80211_node_vdetach         ieee80211.c:826
     └─ ieee80211_sysctl_vdetach(vap)  ieee80211.c:827   <- oid removed only HERE

Everything between the IEEE80211_FREE and ieee80211_sysctl_vdetach — interface detach, state stop, task drains, node table teardown — is the window in which the oid net.wlan.N.rssadapt_rate_interval remains registered (world-readable, CTLFLAG_RW) while its handler (rssadapt_sysctl_interval, ieee80211_rssadapt.c:340-353) dereferences the dangling vap->iv_rs.

Harness demonstration

df3460_harness.c replicates the lifetime with the exact handler code. Buggy run (run.log, guest DragonFly 6.5-DEVELOPMENT #0):

attach          : iv_rs=0x8004902c0 interval=500
read (alive)    : reader gets 500  (ok)
deinit          : iv_rs freed, pointer still 0x8004902c0 (dangling)
window          : chunk reused by poison obj at 0x8004902c0
read (window)   : unprivileged reader gets 0xdeadbeef from FREED chunk
  -> UAF READ confirmed: reader saw the replacement object's bytes (4-byte kernel-heap info leak)
write (window)  : poison.marker2 (offset 8, = interval) now 0x0000012c (was 0xDEADBEEF)
  -> UAF WRITE confirmed: root sysctl write landed in the replacement object
RESULT: BUG REPRODUCED — sysctl handler dereferences freed iv_rs across vap teardown

The allocator handed the freed 16-byte chunk straight back to the replacement object (same address), exactly what DFly's kmalloc size-class zones do cross-type — so the unprivileged reader observes bytes of an unrelated live kernel object, and the root writer corrupts one.

Fixed run (run.fixed.log): deinit clears iv_rs; the handler returns ENXIO during the window; no freed-chunk read or write.

Why Low (and the amrr twin that matters more)

Same latency as DF-0730/DF-0731: rssadapt is not selectable in-tree and the guest has no radio. HOWEVER the identical pattern exists in the default algorithm:

• amrr_sysctl_interval() (ieee80211_amrr.c:390-403) derefs vap->iv_rs freed by amrr_deinit (ieee80211_amrr.c:135) under the same driver teardown order, and
• amrr_sysctlattach() (ieee80211_amrr.c:405-417) registers amrr_max_sucess_threshold / amrr_min_sucess_threshold as SYSCTL_ADD_UINT pointing directly into the chunk — unprivileged reads of those oids in the window UAF-read the freed chunk, root writes UAF-write it.

The amrr twin belongs to ieee80211_amrr.c's own audit (DF-3454 there covers a different defect); it is called out here so it is not lost. On any real WiFi-equipped DragonFly system the amrr version of this window is reachable today.

Fix validation

• fix.diff: rssadapt_deinit frees only if non-NULL and clears vap->iv_rs; rssadapt_sysctl_interval returns ENXIO when iv_rs == NULL.
• git apply-clean against sys/; patched wlan_rssadapt module rebuilds clean under full kernel -Werror CFLAGS (fix_module_build.log, rc=0).
• Harness fixed mode: handler refuses during the window.
• Guest source restored to pristine (sha256 verified) — same one-line fix should be applied to ieee80211_amrr.c by its owner.

Kernel references

sys/netproto/802_11/wlan/ieee80211_rssadapt.c:151-155 (deinit: free without clearing) sys/netproto/802_11/wlan/ieee80211_rssadapt.c:340-353 (handler derefs vap->iv_rs) sys/netproto/802_11/wlan/ieee80211_rssadapt.c:356-362 (oid registration, CTLFLAG_RW) sys/dev/netif/iwm/if_iwm.c:6486-6493 (deinit before vap_detach) sys/netproto/802_11/wlan/ieee80211.c:752,826-827 (sysctl ctx torn down last) sys/netproto/802_11/wlan/ieee80211_amrr.c:135,390-417 (reachable amrr twin)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.