DF-3494 — v1 ng_parse error-path kernel heap leaks (both fixed in ng7)

File: sys/netgraph/netgraph/ng_parse.c (live stack, stock netgraph.ko)

The two sites

1. ng_get_string_token() (:1548-1625) — cbuf = kmalloc(strlen(s + start)) (:1559); every failure-to-find-a-closing-quote path returns NULL at :1624 without freeing cbuf. ng7 added the missing kfree(cbuf) on the same path (ng7 ng_parse.c "no closing quote"). Reachable with attacker-sized strings: NGM_ASCII2BINARY of {name="AAAA… (no closing quote) leaks ~strlen bytes per tokenization — and the composite parse path tokenizes the same unterminated quote 2-3× per message (skip_value + field loop + field parse).

2. ng_string_unparse() (:722-735) — allocates s = ng_encode_string(raw) and the NG_PARSE_APPEND("%s", s) macro does return (ERANGE) on cbuf exhaustion without freeing s (:731). ng7 restructured to free s on the append failure. Because NGM_BINARY2ASCII unparses the arguments buffer with the ng_parse_ng_mesg_type (whose "cmdstr" field lands on attacker-chosen bytes), a payload whose string encoding exceeds the 20 KB response cbuf leaks the whole encode buffer (~4× input size). Additionally ng_unparse_composite()'s own mid-loop appends (" ", "%d=", "%s=" :1274-1285) return ERANGE without freeing the 20 KB workBuf — same class, fixed by ng7's goto fail restructure (covered by fix.diff as defense-in-depth).

Both are kernel-heap exhaustion primitives: unbounded repeat, attacker chosen per-call size (up to ~64 KB string / ~256 KB encode).

Reproduce (guest, root)

kldload ng_socket
cc -O -o ngpleak ngpleak.c && ./ngpleak 2000 1500 5000

• (a) 2000 × ASCII2BINARY unterminated quote → 16-17 MB gone (vm.stats.vm.v_free_count), EINVAL is the expected sync result.
• (b) 1500 × BINARY2ASCII whose inner arglen=20000/0xAA payload makes the string encode exceed the 20 KB cbuf → 117-118 MB gone (~78 KB/call = the ~80 KB encode buffer), ERANGE is the expected sync result.
• Differential controls (nosuchnode: path = transport only → no leak; dlen=2000 success path → no leak) pin the leak to the ERANGE path.
• dmesg.txt shows the kprintf-instrumented proof: per call enc+ 0xfffff801… (≈80 KB) with no enc- — the encode buffer is never freed.

Fix validation

fix.diff ports both ng7 fixes (free cbuf at :1624; free s on append failure in ng_string_unparse) plus the workBuf fail: label. Module rebuilt in-guest and reloaded: (a) 1 MB (noise), (b) 0 MB / 41 pages (noise); vmstat -m shows M_NETGRAPH fully reclaimed (0 in use).

Privilege gate

ngc socket attach requires SYSCAP_RESTRICTEDROOT (sys/netgraph/socket/ng_socket.c:172-173) — real root (jailed root lacks it). Severity accordingly Low; value = upstream parity with the already-fixed ng7 code and defense-in-depth for jails/containers that do grant netgraph access.

DF-3494 — VERDICT

reproduced / dos (kernel heap exhaustion) / certain — two error-path kernel heap leaks in the live v1 ng_parse, both of which the ng7 copy of the same file already fixed upstream.

What was reproduced (stock netgraph.ko, root)

• (a) unterminated-quote token leak — NGM_ASCII2BINARY {name=" + 5000 'A's, 2000 iterations: v_free_count dropped 4239-9749 pages (16-38 MB) across three runs (~2 tokenizations of the ~5 KB string leak per message: skip_value + field loop).
• (b) string-unparse encode leak — NGM_BINARY2ASCII whose inner message makes the ng_parse_ng_mesg_type "cmdstr" field land on attacker bytes with strlen=19980 (see dmesg.txt instrumentation: enc+ with no enc-): 1500 iterations consumed 117-118 MB (~78 KB/call = the ~80 KB ng_encode_string buffer). Sync error ERANGE is the leak-path signature.
• Controls: same-size sends to a nonexistent node (transport only) → no leak; dlen=2000 unparse-success path → no leak. The leak is exclusively on the error paths, matching the code.

Root causes (line-cited)

1. ng_get_string_token :1559 allocates cbuf, :1624 returns NULL on no-closing-quote without kfree → leak per failed tokenization.
2. ng_string_unparse :727 NG_PARSE_APPEND("%s", s) macro-returns ERANGE at :731 without freeing the ng_encode_string buffer s. (Plus the defense-in-depth member: ng_unparse_composite's mid-loop appends :1274/:1278/:1285 return ERANGE leaking the 20 KB workBuf.)

ng7's copy of ng_parse.c contains the frees for both (kfree before "no closing quote" return; ng_parse_append + kfree(s) on append error; goto-fail for workBuf) — this finding is catching the live stack up to the already-fixed ng7 code.

Fix validation

fix.diff (v2) applied to the guest's /usr/src copy, netgraph.ko rebuilt and reloaded: (a) 300 pages (~1 MB, noise) and (b) 41 pages (0 MB) — both leaks eliminated; vmstat -m shows M_NETGRAPH 0 in use. Baseline vs patched outputs in run.3.log vs fixrun.log.

Impact ceiling

Kernel heap exhaustion (system-wide memory starvation → allocation failures/panic under pressure) by the netgraph-controlling user. The ngc socket attach gate is SYSCAP_RESTRICTEDROOT (ng_socket.c:172-173), i.e. real root — hence severity Low, filed for upstream parity and defense-in-depth.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.