DF-4114 — nge(4) TBI mode: sc->nge_miibus = dev self-reference makes nge_detach delete itself — recursion panic / live-device free (UAF)

What this is

When no MII PHY is found and the TBI (ten-bit/fiber) interface is enabled, nge_attach points the miibus handle at the device itself:

} else if (CSR_READ_4(sc, NGE_CFG) & NGE_CFG_TBI_EN) {   /* if_nge.c:860 */
        sc->nge_tbi = 1;
        sc->nge_miibus = dev;                             /* if_nge.c:864 - SELF */

nge_detach then hands that handle to newbus as if it were a child:

if (sc->nge_miibus)
        device_delete_child(dev, sc->nge_miibus);          /* if_nge.c:941-942 = (dev, dev) */

device_delete_child(parent, child) (sys/kern/subr_bus.c:1284-1310) unconditionally does:

if ((error = device_detach(child)) != 0)          /* subr_bus.c:1292 */
        return(error);
while ((grandchild = TAILQ_FIRST(&child->children)))    /* :1296 */
        device_delete_child(child, grandchild);
if (child->devclass)
        devclass_delete_device(child->devclass, child);  /* :1302-1303 */
TAILQ_REMOVE(&dev->children, child, link);        /* :1304 - child NOT a member of dev->children */
TAILQ_REMOVE(&bus_data_devices, child, devlink);  /* :1305 */
kobj_delete((kobj_t)child, M_BUS);                /* :1306 - frees the device */

Two distinct blow-ups:

A. Normal detach (kldunload if_nge / devctl) — unbounded recursion. nge_detach is invoked from device_detach while dev->state is still DS_ATTACHED (state is only set to DS_NOTPRESENT at subr_bus.c:2149, after DEVICE_DETACH returns). The nested device_delete_child(dev, dev) → device_detach(dev) sees DS_ATTACHED (subr_bus.c:2136-2137) → calls DEVICE_DETACH(dev) → nge_detach again → same device_delete_child(dev, dev) → … Each level re-runs the attached block: second bus_teardown_intr on the stale cookie, second ether_ifdetach/if_detach on an already-detached ifnet, double contigfree of nge_ldata and the 3.3 MB jumbo arena — list corruption / double-free panics within a few levels, or kernel stack exhaustion if it somehow gets further. Panic either way.

B. Attach-failure path — live device freed (UAF). nge_attach calls nge_detach(dev) directly on its own goto fail (if_nge.c:921) — e.g. bus_setup_intr failure (if_nge.c:913-916) after the TBI branch was taken. There dev->state is DS_ATTACHING, so the nested device_detach(dev) returns 0 immediately (subr_bus.c:2136-2137 "state != DS_ATTACHED → return(0)"), the grandchild loop is empty, and execution reaches TAILQ_REMOVE(&dev->children, dev, link) (subr_bus.c:1304) — removing the device from a list it is not a member of, which (tqe links being per-entry) silently unlinks dev from its parent PCI bus's children list mid-attach — followed by kobj_delete((kobj_t)dev) (:1306) freeing the live device_t. device_attach then keeps using the freed device (state store, sysctl_fini, printf) → use-after-free write/read in newbus on a root-triggered path.

Threat model

Requires (a) a TBI-mode DP83820 board (fiber/1000baseSX; no external PHY) — NGE_CFG_TBI_EN — and (b) root (kldunload/devctl/driver re-probe, or an IRQ-allocation failure at boot for path B). Privileged + specific hardware → Low severity, but a genuine newbus-corrupting logic bug (and DFly-specific: the TBI branch is a DragonFly addition).

PoC status — untested (hardware absent)

Guest has no DP83820 of any kind (presence_probe.sh); the TBI branch cannot be entered. Source-level certainty: every step above is unconditional on that path.

Fix

Never delete ourselves — guard sc->nge_miibus != dev (fix.diff).

DF-4114 — VERDICT

Finding: In TBI mode nge_attach sets sc->nge_miibus = dev (sys/dev/netif/nge/if_nge.c:864); nge_detach then calls device_delete_child(dev, sc->nge_miibus) = device_delete_child(dev, dev) (if_nge.c:941-942), which newbus does not support.

Status: untested. Hardware-gated: requires a TBI-mode DP83820 (NGE_CFG_TBI_EN, no external PHY) plus root (detach path) or an IRQ-allocation failure at boot (attach-fail path). The audit guest has no NS DP83820 at all (presence_probe.sh: NGE_ABSENT), so neither branch can be entered. Source-level certainty — traced step by step below.

Path A — normal detach (kldunload if_nge, devctl): unbounded recursion → panic. 1. kldunload → device_detach(dev) with dev->state == DS_ATTACHED (sys/kern/subr_bus.c:2136). 2. DEVICE_DETACH(dev) → nge_detach(dev); state is still DS_ATTACHED (it becomes DS_NOTPRESENT only at subr_bus.c:2149, after the method returns). 3. nge_detach reaches if_nge.c:941-942 → device_delete_child(dev, dev) → subr_bus.c:1292 device_detach(dev) → still DS_ATTACHED → DEVICE_DETACH(dev) → nge_detach again → same call → infinite recursion. Each frame re-runs the attached block: second bus_teardown_intr (stale cookie), second ether_ifdetach on an already-detached ifnet, contigfree of nge_ldata and the jumbo arena a second time (if_nge.c:949-954) — double-free/list corruption panics within a few recursion levels; unbounded stack otherwise.

Path B — attach-failure path (nge_attach goto fail → direct nge_detach at if_nge.c:921, e.g. bus_setup_intr failure at :913-916 after the TBI branch): live device freed → newbus UAF. 1. dev->state == DS_ATTACHING during the direct call, so device_is_attached(dev) is false and the stop/teardown block is skipped; sc->nge_miibus == dev is non-NULL → device_delete_child (dev, dev). 2. Nested device_detach(dev) returns 0 immediately (subr_bus.c:2136-2137: state != DS_ATTACHED → 0). 3. grandchild loop empty (TBI mode added no children) → devclass_delete_device (removes the live device from the nge devclass), TAILQ_REMOVE(&dev->children, dev, link) (subr_bus.c:1304) — dev is not a member of its own children list; the per-entry tqe links make this silently unlink dev from the parent PCI bus children list mid-attach — then kobj_delete((kobj_t)dev, M_BUS) (subr_bus.c:1306) frees the live device. 4. device_attach/probe machinery continues on the freed device_t (state stores, devname printf, sysctl) — use-after-free read/write in newbus.

Impact ceiling: privileged DoS with certainty (panic/UAF); on TBI-equipped systems it also bricks driver re-probing for the slot. Not remotely triggerable; no unprivileged path.

Fix: never pass the self-reference to newbus — if (sc->nge_miibus && sc->nge_miibus != dev) (fix.diff; validated as text against the read-only tree, patch --dry-run clean; runtime validation impossible without a TBI DP83820 → fix_status not_tested).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.