DF-4374 — ath sysctl read handlers race driver detach (UAF / unmapped MMIO read)

What

The dev.ath.N.* sysctl read handlers in sys/dev/netif/ath/ath/if_ath_sysctl.c are world-readable, and most of them call into the HAL outside ATH_LOCK with no sc_invalid check and no lifetime guarantee on sc/sc_ah:

• ath_sysctl_txantenna — power-set under lock (:256-258), HAL read at :260 unlocked
• ath_sysctl_diversity — :316-318 lock, :320 unlocked HAL read
• ath_sysctl_diag — :347-349 lock, :351 unlocked ath_hal_getdiag
• ath_sysctl_tpscale :376-378/:380, ath_sysctl_tpc :403-405/:407, ath_sysctl_rfkill :430-432/:434, ath_sysctl_rfsilent :563-565/:567, ath_sysctl_tpack :602-604/:606, ath_sysctl_tpcts :627-629/:631, ath_sysctl_intmit :652-654/:656 — same pattern.

During driver detach, ath_detach() frees sc->sc_ah (ath_hal_detach, if_ath.c:1436) and the PCI layer unmaps the register BARs, all before device_sysctl_fini() (subr_bus.c:2151, called from device_detach only after DEVICE_DETACH returns at :2141) removes the sysctl oids. The per-oid oid_lock (kern_sysctl.c:1460-1482) protects the oid, not the softc: a reader that entered a handler before detach began continues to run while the hardware context is torn down → dereference of freed ath_hal state or an MMIO read from unmapped space → kernel page fault / UAF read → panic.

The read side needs no privilege (sysctl -n dev.ath.0.txantenna as any user); the detach side is privileged (kldunload if_ath, devctl-driven PCI hot-remove, CardBus eject).

Build / Run (probe)

• ./run.sh — unprivileged probe: checks for dev.ath.0.*; if present, runs a reader storm intended to be raced against kldunload if_ath by root. On the audit QEMU guest there is no ath hardware, so it reports absence (see run.log).

Expected on real hardware

With the reader storm running as an unprivileged user and root executing kldunload if_ath (repeatedly), the kernel panics with a page fault in ar5212RegRead/OS_REG_READ or a UAF read of sc_ah — timing-dependent, typically within tens of detach attempts.

Files

• trigger_df4374.sh — reader-storm probe
• VERDICT.md — lifetime analysis with citations
• fix.diff — hold ATH_LOCK across the HAL interaction and bail out when the device is invalid (representative for all affected handlers)

DF-4374 VERDICT — sysctl read handlers vs ath driver detach lifetime race

Status: not_reproduced — no Atheros hardware in the audit QEMU guest (dev.ath tree absent, no 0x168c PCI device). Lifetime analysis verified from source; the race is real but the detach side is privileged, so impact ceiling is a race-condition kernel panic (DoS).

Reproduction attempt (honest)

• Guest: DragonFly 6.5-DEVELOPMENT, vtnet0 lo0 only; sysctl -n dev.ath.0.slottime → "unknown oid 'dev.ath'" as both root and user (run.log). pciconf -l shows no Atheros (0x168c) device.
• trigger_df4374.sh executed: reports the absent device and exits.
• Cannot execute the race without ath(4) hardware → not_reproduced, impact none observed on this guest.

Why the race is real (citations)

1. Unprivileged read surface. All dev.ath.N.* leaves are created with SYSCTL_ADD_PROC(..., CTLTYPE_INT | CTLFLAG_RW, ...). Reads need no privilege; only writes are gated (kern_sysctl.c:1446-1447: caps_priv_check(td->td_ucred, SYSCAP_NOSYSCTL_WR) unless CTLFLAG_ANYBODY). Any local user can enter these handlers.

2. Handlers unlock before touching the HAL. Representative: ath_sysctl_txantenna takes ATH_LOCK for ath_power_set_power_state (if_ath_sysctl.c:256-258), releases it, then calls ath_hal_getantennaswitch(sc->sc_ah) at :260 with no lock and no sc_invalid test. Same pattern at :320, :351, :380, :407, :434, :567, :606, :631, :656. (slottime/acktimeout/ctstimeout/rxantenna do the read under ATH_LOCK but are still exposed to the softc lifetime problem below.)

3. Driver detach destroys the hardware context while oids are live. device_detach (subr_bus.c:2131-2152) runs DEVICE_DETACH — for ath: ath_detach (if_ath.c:1385-1438) stops the chip, frees DMA, and calls ath_hal_detach(sc->sc_ah) at :1436 (frees the HAL object) — and only afterwards calls device_sysctl_fini(dev) at :2151, which is what removes/frees the dev.ath.N.* oids. The PCI detach then unmaps the register BARs.

4. The sysctl lock protects the oid, not the softc. Handlers execute under the per-oid lockmgr lock (kern_sysctl.c:1460-1482; shared for reads). device_sysctl_fini/sysctl_ctx_free must take the exclusive oid lock, so it waits for readers — but that only prevents oid UAF; it does nothing to stop ath_detach from freeing sc_ah while a reader is parked between its ATH_UNLOCK and its HAL call.

5. Result. Reader at :260 during/after ath_hal_detach: - reads ah->ah_sc-adjacent state from freed memory (UAF read), and/or - executes OS_REG_READ(ah, ...) through a bus-space handle whose BAR mapping was torn down → kernel-mode access to unmapped device space → page fault → panic.

Impact

Race-condition local DoS (kernel panic). The reader side is unprivileged but the detach side requires root (kldunload if_ath) or physical hot-removal — per the audit rubric this is Low ("narrow trigger ... requires specific hardware or already-privileged user" for the triggering half).

Fix validation

Not possible on this guest (no ath hardware). fix.diff shows the pattern: check sc_invalid under ATH_LOCK and keep the lock across the HAL interaction so ath_detach's ATH_LOCK-serialized teardown cannot proceed underneath the reader; apply the same shape to every listed handler. fix_status: not_testable (hardware absent).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.