DF-3669 — ix(4) detach leaves self-re-arming tx_gc_timer callout armed → use-after-free of tx_rings

File: sys/dev/netif/ix/if_ix.c · Severity: Low (root-only trigger: kldunload/hot-remove) · Class: lifetime/UAF

PoC

No runnable PoC: requires (a) an attached ixgbe NIC (guest has none, env.txt) and (b) an unprivileged-code-unreachable event — driver detach (kldunload or PCI hot-removal), which is root-only. Documented source-level race:

1. ix_txgc_timer() (if_ix.c:352-374) re-arms itself unconditionally at the done: label: callout_reset(&txr->tx_gc_timer, 1, ix_txgc_timer, txr) (if_ix.c:373) — while the interface is RUNNING there is always a pending armed callout.
2. ix_stop() only does callout_stop(&txr->tx_gc_timer) (if_ix.c:1767) — callout_stop() does not wait for an in-flight callback; a callback executing concurrently takes the goto done path (its lwkt_serialize_try fails while detach holds all serializers) and re-arms the callout after the stop.
3. ix_detach() terminates sc->timer and sc->fw_timer (if_ix.c:693,696) but never the per-ring tx_gc_timer, then frees the rings: ix_free_rings() (if_ix.c:721) → ix_destroy_tx_ring() (if_ix.c:2102-2122, frees tx_base/tx_buf/DMA maps) and kfree(sc->tx_rings) (if_ix.c:4002).
4. The re-armed 1-tick callout fires on freed memory: reads txr->tx_sc->arpcom.ac_if.if_flags, then lwkt_serialize_try(&txr->tx_serialize) — a write into freed slab memory — and callout_reset on the freed embedded callout.

Fix validation (compile-level)

fix.diff adds callout_terminate() for every tx_gc_timer in ix_detach() before rings are freed (terminate disarms AND waits for running callbacks). Compile-validated on the guest's md5-identical /usr/src (build_patched.log, -Werror clean).

DF-3669 — VERDICT

Status: inconclusive (runtime) / source-level certain. Impact class: use-after-free on driver detach. Root-only trigger, narrow race window.

Root cause and race walk

• ix_txgc_timer() (if_ix.c:352-374) is a 1-tick self-re-arming callout (re-arm at if_ix.c:373). While the interface is RUNNING, an armed callout is pending essentially always; early returns at 357-359/364-368 are the only non-re-arming exits and require IFF_RUNNING to already be clear.
• ix_stop() (called from ix_powerdown() under ifnet_serialize_all() in ix_detach(), if_ix.c:686-689) issues only callout_stop(&txr->tx_gc_timer) (if_ix.c:1767). DragonFly callout_stop() disarms a pending callout but does not wait out a currently executing callback.
• A concurrently executing callback on the ring's pinned CPU (tx_gc_timer is callout_init_mp, reset via callout_reset_bycpu(..., txr->tx_intr_cpuid) at if_ix.c:1157) observes: flags check passes (pre-stop), lwkt_serialize_try(&txr->tx_serialize) FAILS (detach holds all serializers via ifnet_serialize_all), so it takes goto done → callout_reset(1 tick) — re-armed after the stop.
• ix_detach() then: callout_terminate(&sc->timer) (693), callout_terminate(&sc->fw_timer) (696) — no terminate for tx_gc_timer — releases resources (if_ix.c:698-735), and ix_free_rings() (721) frees tx_base/tx_buf/DMA maps (ix_destroy_tx_ring, if_ix.c:2090-2123) and the ring array itself (kfree(sc->tx_rings), if_ix.c:4002).
• ~10 ms later (1 tick at hz=100) the orphaned callout fires:
• reads txr->tx_sc->arpcom.ac_if.if_flags from freed memory (UAF read),
• lwkt_serialize_try(&txr->tx_serialize) — atomic RMW write into freed slab memory,
• callout_reset() on the freed embedded struct callout — corrupts the per-CPU callout queue. If the slab is reused (M_DEVBUF) between free and fire, the callback dispatch itself reads attacker-influenced function/argument pointers.

Trigger conditions & severity

• Requires an attached ix(4) device and driver detach (kldunload if_ix is impossible when built-in; device_delete/hot-remove or module unload on a modular kernel) — root-only, so Low per the audit rubric.
• The race window is one callback execution per tick; under TX GC load with a module build, repeated kldunload-under-traffic eventually hits it.

Verification performed

1. Source walk (all lines cited above) — no callout_terminate for tx_gc_timer anywhere in the driver (rg confirms only callout_stop at 1767).
2. Guest has no ixgbe NIC (env.txt): ix_attach() never runs, no callout is ever armed → runtime reproduction impossible on this guest; also the trigger needs root, so it would be out of scope for an unpriv escalation anyway.
3. fix.diff adds the missing callout_terminate() loop in ix_detach() (guarded by sc->tx_rings != NULL for the attach-failure path). Compile-validated: patched if_ix.ko builds with -Werror, clean (build_patched.log); guest /usr/src restored to pristine afterwards.

Recommended fix

fix.diff in this pack.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.