DF-4343 — mn_attach error-path asymmetry: unreleasable/leaked BARs, success-returned failures, dangling sc->node, no detach

• File: sys/dev/netif/mn/if_mn.c
• Lines: 1301-1317 (BAR allocs; struct resource *res local-only), 1324-1335 (leaking ENXIO returns), 1353-1355 (mn_reset failure returns success), 1386-1389 (ng_make_node_common failure returns success), 1392-1396 (name-failure frees node, softc keeps dangling pointer, returns success), 1402-1411 (no device_detach)
• Severity: Low (privileged attach-time/hardware-error paths; resource-exhaustion and dangling-pointer hygiene, no direct unprivileged trigger)
• CVSS: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
• CWE: CWE-772 (protected resource not freed) / CWE-404 (improper shutdown) / CWE-252 (unchecked return)
• Confidence: certain (plain code reading)

Summary

mn_attach violates attach error-path symmetry in five distinct ways:

1. BAR struct resource * handles are discarded. Both memory BAR allocations use a local res (if_mn.c:1302, :1311); only rman_get_virtual()/rman_get_start() are saved into the softc (:1307-1308, :1316-1317). The resource handles themselves are never stored, so they can never be bus_release_resource'd — on the success path they are held forever, and on every error return below they leak.

2. Each early ENXIO leaks everything allocated before it: second-BAR failure leaks BAR0 (:1311-1315); IRQ-alloc failure leaks both BARs (:1324-1327); bus_setup_intr failure leaks both BARs plus the IRQ (:1332-1335). Failed attaches can be repeated (rescan, slot churn) and accumulate leaked bus resources.

3. Failure returned as success. When the controller fails the PCI bus-master test, mn_reset returns 0 and attach does if (!u) return (0); (:1353-1355) — the device reports attach SUCCESS while non-functional, with the interrupt live and no netgraph node. Likewise ng_make_node_common failure prints and return (0) (:1386-1389).

4. Name-failure path frees the node but leaves sc->node dangling (:1392-1396): ng_rmnode + ng_unref drop the creation reference (node refs → 0 → kfree) — note ngmn_shutdown is a no-op returning EINVAL (if_mn.c:280-285) so ng_cutlinks never runs — and the softc (still referenced by device_set_softc, interrupts live) keeps pointing at freed memory forever. Returns success (0) on top.

5. No device_detach method at all (:1402-1411): IRQ teardown, resource release, softc free and netgraph node removal are impossible; hot-unplug or module unload leaks the softc, both BARs, the IRQ and the node.

Threat

Attacker relevance is indirect: repeated failed attaches (card mis-seated / bus-master-disabled slot / IRQ exhaustion) leak kernel bus resources (CWE-772), and the dangling sc->node (item 4) is a latent UAF pointer that future code paths touching sc->node would dereference. Requires the mn hardware and privileged (re)scan operations — hence Low.

Exploit / PoC

No runnable PoC beyond source inspection is possible on the audit guest (no card, driver not built — see run.log / env_guest.txt). Deterministic source-level demonstration: grep -n "bus_release_resource" if_mn.c → no matches; grep -n "device_detach" if_mn.c → no matches; the five code sites cited above.

Recommended fix

Retain both BAR handles in the softc and release them (plus the IRQ) on every error path; return ENXIO on mn_reset/ng_make_node_common failure; on name failure set sc->node = NULL after destroying the node and return ENXIO; add a device_detach implementing the inverse of attach. See fix.diff for the minimal resource/return-value half (full detach requires lifecycle work out of scope for a minimal patch).

DF-4343 VERDICT

Status: inconclusive on this guest (defect is static/plain-code) reproduced: 0 · impact on this guest: none · confidence: certain

All five defects are verifiable by direct source reading and greps; nothing depends on runtime hardware behavior:

• res locals at if_mn.c:1302 / :1311 are never stored in struct softc (fields m0v/m0p/m1v/m1p hold only virtual/physical values, if_mn.c:1307-1308, :1316-1317); grep -n bus_release_resource sys/dev/netif/mn/if_mn.c → no matches (resources unreleasable by construction).
• Early returns at :1314, :1326, :1334 discard previously allocated resources.
• :1353-1355 if (!u) return (0); — mn_reset failure reported as attach success.
• :1386-1389 ng_make_node_common failure → return (0).
• :1392-1396 name failure: ng_rmnode + ng_unref free the node (refs 1→0 via the no-op ngmn_shutdown at if_mn.c:280-285, which never calls ng_cutlinks), leaving sc->node dangling in the still-live softc, then return (0).
• :1402-1411 device_methods contains no device_detach.

Guest verification attempt (see run.log): no 0x110a PCI device, driver not built (optional mn netgraph), kldload if_mn ENOENT — attach paths cannot be exercised at runtime on this guest; classification inconclusive for the reproduction while the defect itself is certain from source.

Fix: fix.diff (git apply --check clean): retain both BAR handles in the softc (mem0, mem1), release them + the IRQ on every error path, return ENXIO on mn_reset / ng_make_node_common / ng_name_node failures, NULL the node pointer after destroying it. A full device_detach is additionally recommended upstream but is intentionally out of the minimal patch.

Files

README.md, VERDICT.md, run.sh, run.log, env_guest.txt, fix.diff, verdict.json, manifest.json (no runtime trigger exists for this class; source-level citations are the demonstration).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.