DF-3526 — netgraph7 ng_iface: first node creation panics in kfree(NULL)

(bcopy() UB makes GCC drop the NULL guard on ng_iface_units)

What

Creating the first netgraph7 ng_iface node panics the kernel deterministically:

panic: trying to free NULL pointer
_kfree() at _kfree+0x558
ng_iface_constructor() at ng_iface_constructor+0x312
ng_make_node() -> ng_apply_item() -> ngthread()

ng_iface_get_unit() (sys/netgraph7/iface/ng_iface.c:292-303) passes the initially-NULL ng_iface_units to bcopy(). sys/systm.h maps bcopy onto __builtin_memmove and documents that GCC may then assume the operand non-NULL and delete later NULL tests — the if (ng_iface_units != NULL) guard at :300 is dead code in the compiled module, so the first array-growth (i.e. the FIRST node ever created) calls kfree(NULL), which is an unconditional panic() (sys/kern/kern_slaballoc.c:1406-1407). Production (non-INVARIANTS) kernels are equally affected.

This is the ng7 twin of v1 DF-3485 (sys/netgraph/iface/ng_iface.c:290-295): same code pattern, separate file/module (ng7 module set), separate fix.

NOTE: the OTHER half of the v1 lead does NOT carry over — ng7 does NOT share DF-3486 (if_attach from netisr control path). ng7 funnels every first-hop control message to the dedicated ngthread via lwkt_sendmsg(ng_cpuport(0)) (ng_base.c:1956-1961), a kernel-thread context in which if_attach() is legal: with only the bcopy fix applied, the full ng_iface lifecycle (mkpeer -> ng0 -> GET_IFNAME -> shutdown) succeeds, 20/20 + a parallel pair. See VERDICT.md.

Trigger privilege

ROOT ONLY (verified live): ng7 ng_socket control sockets require caps_priv_check(SYSCAP_RESTRICTEDROOT) (sys/netgraph7/socket/ng_socket.c:182-185); uid 1001 gets EPERM (unpriv_check.txt). Severity Low (privileged DoS).

Build / Run (in-guest, root)

# 1. build ng7 modules (netgraph core, ng_socket, ng_iface)
cd /usr/src/sys/netgraph7/netgraph  && make
cd ../socket                        && make
cd ../iface                         && make
cc -O2 -o iface_con iface_con.c

# 2. load and fire
kldload /usr/src/sys/netgraph7/netgraph/netgraph.ko
kldload /usr/src/sys/netgraph7/socket/ng_socket.ko
kldload /usr/src/sys/netgraph7/iface/ng_iface.ko
./iface_con create          # -> instant panic, guest dead

Expected

Stock modules: panic: trying to free NULL pointer at ng_iface_constructor+0x312 (the unguarded kfree; see panic.txt, disasm.stock.txt + reloc.stock.txt: +0xd76 memmove flows into +0xdce _kfree with no NULL test). Reproduced 3/3 on independent boots (run.log, run.2.log, run.3.log).

With fix.diff (module rebuild only): creation succeeds (disasm.fix26.txt: real test/je before kfree), ifname=ng0, clean shutdown, 20/20 lifecycle + parallel stress clean (fix_run.log).

Fix validation

cd /usr/src && patch -p1 < fix.diff   # bcopy call guarded by units_len>0
(rebuild ng_iface module only, reload, run stress.sh)

DF-3526 VERDICT — REPRODUCED (panic, deterministic 3/3, root-only)

Bottom line

Creating the first netgraph7 ng_iface node on the stock kernel panics instantly and 100% deterministically: panic: trying to free NULL pointer from ng_iface_constructor+0x312, reached through the inlined ng_iface_get_unit() (sys/netgraph7/iface/ng_iface.c:292-303). Root cause is a compiler-visible UB pattern, proven not a stale binary: bcopy(ng_iface_units, ...) at ng_iface.c:296 feeds __builtin_memmove() a pointer that is NULL on the first call; per the in-tree contract (sys/sys/systm.h:257-260) GCC then assumes the pointer non-NULL and deletes the if (ng_iface_units != NULL) guard at :300, so the compiled module calls kfree(NULL) unconditionally on the array-growth path — which is exactly the first-creation path. kfree(NULL) is an unconditional panic (sys/kern/kern_slaballoc.c:1406), so non-INVARIANTS production kernels are equally affected. This is the ng7 twin of v1 DF-3485, independently verified against the ng7 module set.

How it was proven

1. Machine code, freshly built (disasm.stock.txt, reloc.stock.txt, GCC 8.3 DragonFly): in ng_iface_constructor, the load of ng_iface_units at +0xd4d flows through memmove (reloc at +0xd76) into call _kfree (reloc at +0xdce) with no NULL test in between. The panic return address +0x312 matches this exact call.
2. Live reproduction, 3/3 across independent vm.sh reset with-src boots with freshly built stock modules: ./iface_con create (root, ng7 control socket, NGM_MKPEER type "iface") → guest dead every time with the identical trace (panic.txt, run.log, run.2.log, run.3.log): _kfree+0x558 <- ng_iface_constructor+0x312 <- ng_make_node+0x5f <- ng_apply_item+0x666 <- ngthread+0x18
3. Trigger is root-only: ng7 ng_socket control-socket attach is gated by caps_priv_check(SYSCAP_RESTRICTEDROOT | __SYSCAP_NULLCRED) (sys/netgraph7/socket/ng_socket.c:182-185); uid 1001 gets EPERM (unpriv_check.txt). Severity: Low (privileged deterministic DoS).
4. Fix validation (fix.diff, module rebuild only, no kernel rebuild): disasm.fix26.txt shows a real test %r10,%r10 / je now dominating the kfree, and the ng_iface_units_len > 0 guard around the bcopy. Live: full lifecycle succeeds — mkpeer survives, GET_IFNAME returns "ng0", NGM_SHUTDOWN clean; 20/20 serial + 2 parallel create/destroy cycles, zero panics (fix_run.log).

The DF-3486 half of the lead is REFUTED for ng7

With only the bcopy fix applied (DF-3526), node creation proceeds to if_attach(ifp, NULL) (ng_iface.c:624) and succeeds — no "try holding ifnet lock in netisr" panic, no deadlock. Mechanically: ng_snd_item() queues every first-hop item (refs == 1 — which is every control message entering netgraph from ng_socket) to cpu0's netgraph port: lwkt_sendmsg(ng_cpuport(0), msg) (ng_base.c:1956-1961), where the dedicated ngthread (a kernel thread, not a netisr) applies it. The DF-3486 v1 panic came from v1's control path running on a TD_TYPE_NETISR thread; ng7's thread model differs (exactly the audit lead's "token model differs" hint), and in ngthread context if_attach()'s ifnet lock and netmsg_service_sync() are legal. Empirical + mechanical: ng7 ng_iface does NOT share DF-3486.

Side benefit: because all ng7 control messages (constructors and shutdowns alike) funnel through the single cpu0 ngthread, the unsynchronized ng_iface_units bitmap is serialized by construction — the parallel create test (fix_run.log) exercised exactly that.

Impact characterization

kfree(NULL) is caught by the allocator's explicit NULL check before any memory is touched — a clean, deterministic panic (DoS). There is no write primitive, no double-free, no corruption: the stop is inside kfree's argument validation. No escalation path exists from this bug.

Relation to prior findings

• DF-3485 (v1 sys/netgraph/iface/ng_iface.c): same root cause, v1 module set; verified 3/3 there too. DF-3526 is the independent ng7 copy — separate file, separate module, separate fix commit.
• DF-3486: NOT shared (see above).
• DF-0607 (BPF write uninit sa_data on the same ng7 file): unrelated, not re-reported here.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.