ng_socket: unsynchronized priv->node / priv->datasock reads in ngc_send/ngd_send/ngs_connect/ngs_disconnect/ngs_rcvdata race mtx-protected teardown — NULL-deref/UAF panic
Summary
struct ngsock fields are mutated only under priv->mtx (detach/shutdown/connect), but five hot paths read them bare: ngc_send :310, ngd_send :443/:451, ngs_connect :864, ngs_disconnect :1028, ngs_rcvdata :978. ngd_send/ngs_rcvdata run on the data socket's protocol thread while node teardown runs on the netgraph cpu0 queue thread - genuinely different CPUs. If ngs_shutdown NULLs priv->node between the :443 read and the :451 deref, the unprivileged sender gets a NULL-deref panic; if the read catches the pointer just as the node reference is dropped it is a node UAF read. Same discipline gap as DF-0537 (which covered ng_connect_data only); these five sites are distinct. Local panic-DoS; unpriv side needs a root-configured graph + concurrent teardown; narrow window. Not reproduced (race-hammering teardown loops cost seconds per attempt); filed on lock-usage asymmetry. Fix: mtx around the loads + node ref/re-check. [VERIFIED pass2: 150 teardown cycles no panic; ng7 data-socket producer path rejected sends so ngd_send never exercised, honest caveat; analysis unchanged]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3510 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 305 B | ↓ raw | |
| VERDICT.md | — | 1.6 KB | ↓ raw | |
| env.txt | — | 329 B | view raw | |
| fix.diff | — | 405 B | view raw | |
| manifest.json | — | 733 B | view raw | |
| run.log | — | 197 B | view raw | |
| verdict.json | — | 1.9 KB | view raw |
DF-3510 - ng7 socket unsynchronized teardown reads
Harness kernel. gcc -O -pthread -o ngrace7 ngrace7.c; ./ngrace7 150. No panic; producer caveat in VERDICT.md.
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 25 20:46:48 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_NG7 x86_64 (harness kernel)
DF-3510 - VERDICT
status: not_reproduced | reproduced: 0 | impact: none | confidence: likely
Not reproduced: 150 teardown cycles (ngrace7.c: per cycle build socket-node+echo graph, associate a data socket, flood data sends from a thread while NGM_SHUTDOWN tears the node down) completed with no panic. Producer caveat, honestly noted: the ng7 data-socket send path rejected the flood in this environment (0 successful data sends across send()/sendto attempts - association/destination friction), so the ngd_send side of the race was not actually exercised; only the teardown side ran. The five unsynchronized priv->node/priv->datasock reads (ngc_send :310, ngd_send :443/:451, ngs_connect :864, ngs_disconnect :1028, ngs_rcvdata :978 area) against the mtx-protected shutdown remain code-certain; NULL-deref/node-UAF panic ceiling under a working producer. Filed on lock-usage asymmetry - unchanged by this run.
Kernel references
- sys/netgraph7/socket/ng_socket.c:310
- sys/netgraph7/socket/ng_socket.c:443
- sys/netgraph7/socket/ng_socket.c:978
- sys/netgraph7/socket/ng_socket.c:1028
Evidence
run.log (NGRACE7-DONE 150 cycles, 0 data sends, no panic), ngrace7.c
Recommended fix
take priv->mtx around the bare reads and re-check node validity (as DF-0537 did for ng_connect_data).
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
run.log (NGRACE7-DONE 150 cycles, 0 data sends, no panic), ngrace7.c
PoC changes
ngrace7.c written fresh (ng7 wire format); data-producer path could not be driven
Verified recommended fix
take priv->mtx around the bare reads and re-check node validity (as DF-0537 did for ng_connect_data).
Verdict
Not reproduced: 150 teardown cycles (ngrace7.c: per cycle build socket-node+echo graph, associate a data socket, flood data sends from a thread while NGM_SHUTDOWN tears the node down) completed with no panic. Producer caveat, honestly noted: the ng7 data-socket send path rejected the flood in this environment (0 successful data sends across send()/sendto attempts - association/destination friction), so the ngd_send side of the race was not actually exercised; only the teardown side ran. The five unsynchronized priv->node/priv->datasock reads (ngc_send :310, ngd_send :443/:451, ngs_connect :864, ngs_disconnect :1028, ngs_rcvdata :978 area) against the mtx-protected shutdown remain code-certain; NULL-deref/node-UAF panic ceiling under a working producer. Filed on lock-usage asymmetry - unchanged by this run.
No comments yet.