DF-3540 — netgraph7 ng_bpf: cyclic ifMatch/ifNotMatch forwarding → unbounded synchronous recursion → kernel panic

What

ng_bpf_setprog() (sys/netgraph7/bpf/ng_bpf.c:584-585) resolves ifMatch/ifNotMatch with ng_findhook() and stores the result as a direct forwarding target, with no validation that the targets differ from thisHook and no cycle detection. netgraph7 forwards items whose refcount is > 1 synchronously — NG_FWD_ITEM_HOOK → ng_snd_item() → ng_apply_item() → the peer's rcvdata() → NG_FWD_ITEM_HOOK → … — with no hop bound (sys/netgraph7/netgraph/ng_base.c:1908-1965). Each hop also takes the destination node's LWKT token (ng_acquire_read, ng_base.c:1998) recursively.

A cyclic configuration — two ng_bpf nodes cross-connected, each with ifMatch == thisHook ("self" mode), or a pure multi-hook ifMatch cycle with no self-reference at all ("cross" mode) — makes one injected packet recurse until the kernel thread's LWKT token reference array (td_toks_array[LWKT_MAXTOKENS == 32], sys/sys/thread.h:331) overflows:

panic: assertion "ref < &td->td_toks_end" failed in lwkt_gettoken_shared
       at /usr/src/sys/kern/lwkt_token.c:732     (KKASSERT: all builds)
lwkt_gettoken_shared() at lwkt_gettoken_shared+0x34c
lwkt_gettoken_shared() at lwkt_gettoken_shared+0x34c
ng_apply_item() at ng_apply_item+0xa9
ng_apply_item() at ng_apply_item+0x105     (recursive)
...

The KKASSERT is compiled into production (non-INVARIANTS) kernels too, so the panic is deterministic everywhere. Without the token-array tripwire the recursion would instead exhaust the ngthread kernel stack.

Trigger privilege

ROOT ONLY (verified live): ng7 control sockets require caps_priv_check(SYSCAP_RESTRICTEDROOT) (sys/netgraph7/socket/ng_socket.c:182-185); uid 1001 gets EPERM (unpriv_check.txt). Root must build the cyclic graph; one packet (sent by root, or by any traffic source once configured) panics the machine. Severity Low (privileged DoS) — same class as DF-3486/DF-0679.

Build / Run (in-guest, root, clean /usr/src)

sh build.sh          # ng7 netgraph.ko + ng_socket.ko + ng_bpf.ko + trigger
sh run.sh self       # expect panic (console: token-array assertion)
# after reboot:
sh run.sh cross      # expect same panic (cycle class, no self-reference)

Fix validation (fix.diff)

stock self → panic cross → panic ng_bpf guard only self → EINVAL cross → panic (fix1_.log) full fix self → EINVAL cross → survives (fix2_.log)

fix.diff = (1) ng_bpf.c rejects ifMatch/ifNotMatch == thisHook (kills the trivially-configurable self cycle); (2) ng_base.c bounds synchronous forwards per item (el_hops, NG_HOPS_MAX = 16, ELOOP) — the general guard covering cycles built from any node types.

DF-3540 — VERDICT

Status: reproduced. Impact: panic (kernel DoS, root-gated). Confidence: certain.

How it was reproduced

Guest: DragonFly 6.5-DEVELOPMENT #0 (stock INVARIANTS kernel), ng7 module stack (netgraph.ko, ng_socket.ko, ng_bpf.ko) built from the guest's clean /usr/src — build.sh / run.sh. Trigger bpf_cycle.c uses the AF_NETGRAPH control+data socket API (NG_VERSION 8; sockaddr_ng data at offset 2 — DFly sa_family_t is __uint8_t):

1. control socket node named "bpcyc" (NGM_NAME), data socket connected to it ("bpcyc:" absolute-node addressing).
2. mkpeer bpf (B1), mkpeer bpf from B1 (B2), three NGM_BPF_SET_PROGRAMs: - self mode: B1.x2: ifMatch=x1, B1.x1: ifMatch=x1 (self), B2.y1: ifMatch=y1 (self). Steady loop B1.x1 ↔ B2.y1. - cross mode: B1 hooks e/p/r, B2 hooks q/s (NGM_CONNECT wires B1.r↔B2.s); programs B1.e→p, B1.r→p, B2.q→s. Loop B1.r → B2.q → B1.r. No ifMatch equals its own thisHook anywhere.
3. one 1-byte packet injected via the data socket.

Both modes: kernel dies instantly (ssh hangs, guest down). Serial console:

panic: assertion "ref < &td->td_toks_end" failed in lwkt_gettoken_shared
       at /usr/src/sys/kern/lwkt_token.c:732
lwkt_gettoken_shared() x2, ng_apply_item() x3+ recursive
Debugger("panic")

(panic.txt, console_full.txt, console_cross.txt)

Why it happens (source trace)

• ng_bpf.c:584-585 — hip->match = ng_findhook(node, prog->ifMatch) — any hook name accepted, including thisHook itself; no cycle check.
• ng_bpf.c:500 — NG_FWD_ITEM_HOOK(error, item, dest).
• netgraph.h:861-872 → ng_base.c:1908 ng_snd_item(): items with refs>1 are applied synchronously (line 1961) — each forward is a stack frame chain, no hop limit.
• ng_base.c:1998 ng_acquire_read() → lwkt_gettoken_shared() pushes a tokref into td_toks_array[LWKT_MAXTOKENS=32] (sys/sys/thread.h:331); recursive acquisition per hop; 32 acquisitions → KKASSERT at lwkt_token.c:732 (always compiled — KKASSERT, not KASSERT).
• netgraph7 dispatches everything on the cpu0 ngthread (ng_base.c:1948-1956), so the recursion is on a kernel thread stack.

The framework property (no cycle guard on synchronous forwarding) is the root enabler; ng_bpf's SET_PROGRAM is the stock node type that makes a cycle expressible with two/three control messages. The same framework property is reachable through other forwarding node types (e.g. an ng_echo pair), which is why fix.diff fixes both layers.

Exploit chain

None beyond denial of service: root-gated configuration, deterministic panic. No memory-safety violation (the overflow tripwire is an always-on KKASSERT; no controlled overwrite occurs before it).

Fix validation (fix.diff)

Applied as module rebuilds on the same stock kernel:

fix_status: fixed.

Residual notes

• NG_HOPS_MAX=16 chosen so worst-case recursion stays well inside a 2-page kernel thread stack; legitimate netgraph paths are far shallower. Upstream may prefer queueing instead of recursion (FreeBSD-style), which removes the need for the bound.
• v1 netgraph (sys/netgraph/bpf/ng_bpf.c) forwards synchronously too (v1 ng_send_data calls rcvdata directly, ng_base.c:1687) — the v1 twin of this bug exists but v1 ng_bpf is a separate file with its own audit record (DF-2595 et al.); not re-filed here.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.