DF-4893 — ah_osdep.c ALQ logging global ath_hal_alq TOCTOU (use-after-free of struct alq) — LATENT / COMPILED-OUT

File: sys/dev/netif/ath/ath_hal/ah_osdep.c (pass 2, GLM 5.3) Severity: Info (latent — not reachable in any stock DragonFly build)

The defect (code shape, certain)

Inside #ifdef AH_DEBUG_ALQ (ah_osdep.c:188-364) the ALQ register-tracing global ath_hal_alq is consumed without any lock:

• ath_hal_reg_write ah_osdep.c:297 if (ath_hal_alq) → :298 ath_hal_alq_get(ah)
• ath_hal_reg_read ah_osdep.c:336 if (ath_hal_alq) → :337 ath_hal_alq_get(ah)
• OS_MARK ah_osdep.c:353 if (ath_hal_alq) → :354 ath_hal_alq_get(ah)

ath_hal_alq_get (:258-280) dereferences the global twice more (alq_get(ath_hal_alq, ALQ_NOWAIT) at :264 and :276).

The closer is the sysctl handler sysctl_hw_ath_hal_log (:239-250) → ath_hal_setlogging(0) (:216-237):

if (ath_hal_alq)
        alq_close(ath_hal_alq);   /* frees the struct alq */
ath_hal_alq = NULL;               /* :232 — no lock, no barrier */

Window: CPU0 in a register access passes the if (ath_hal_alq) check at :297/:336/:353 → CPU1 (root, sysctl hw.ath.hal.alq=0) runs alq_close() (free) + NULL-store → CPU0 calls alq_get() on the freed struct alq and alq_post() writes through it → use-after-free write in kernel context.

Classic CWE-367. Inherited FreeBSD lineage: the block is verbatim FreeBSD HAL OS-glue of the 9.x era (note /*#include <sys/alq.h> FreeBSD */ at :202).

Why it is unreachable on stock DragonFly (triple-gated)

1. Option is off: the whole block is #ifdef AH_DEBUG_ALQ; the options AH_DEBUG_ALQ → opt_ah.h mapping is commented out at sys/conf/options:551, so config(8) rejects any kernel config that names it. You cannot build this code without editing source.
2. No alq(9) exists: #include <sys/alq.h> is commented out (:202) and there is no alq.h, no kern_alq.c, no alq_open/alq_get/alq_post definition anywhere in the DF tree (verified: find sys -name "alq*" → only DF-local if_ath_alq.h / ieee80211_alq.h, whose own .c files are excluded from the build or gate their alq use behind the same dead option). Even with the option force-defined, this TU cannot compile.
3. Second build break: the ALQ-branch ath_hal_reg_read (:316-348) calls ath_hal_reg_whilst_asleep(ah, reg) at :324, but that helper is defined only under #ifdef AH_DEBUG (:153-171) — AH_DEBUG_ALQ without AH_DEBUG is a second compile error. The block was never compile-tested on DF.

Runtime proof on the audit guest (ath compiled into GENERIC, no Atheros NIC):

# sysctl hw.ath.hal.alq
sysctl: unknown oid 'hw.ath.hal.alq'
# sysctl hw.ath.hal.debug
sysctl: unknown oid 'hw.ath.hal.debug'
# sysctl hw.ath.hal.alq_logfile
sysctl: unknown oid 'hw.ath.hal.alq_logfile'

Additionally, even in FreeBSD where the code does build: the trigger needs a privileged actor toggling hw.ath.hal.alq at the same instant another CPU is inside a register access (any ath traffic). Root-gated race → low value even upstream.

Reproduce (documentary)

build.sh / run.sh probe the preconditions on a DragonFly host:

./run.sh   # reports: option mapping state, presence of sys/alq.h,
           # presence of hw.ath.hal.alq oid, presence of ath hardware

Expected on any stock DF: preconditions ABSENT → race not reachable (exit 3). The race itself would need: hand-patched opt_ah.h (AH_DEBUG_ALQ+AH_DEBUG), an imported alq(9), an Atheros NIC, and root toggling the sysctl concurrent with register traffic (trigger.c documents that two-thread shape).

Fix

Recommended: delete the dead block (it cannot build), or — if/when alq(9) is imported — re-add it with the global protected by a mutex on both the consumer and closer paths (check/get under one lock; disable path takes the same lock, closes, NULLs), and fix the ath_hal_reg_whilst_asleep guard. See fix.diff.

DF-4893 VERDICT — ah_osdep.c ALQ TOCTOU/UAF: latent, unreachable on stock DF — untested (no runnable path)

Bottom line

The AH_DEBUG_ALQ block of sys/dev/netif/ath/ath_hal/ah_osdep.c contains a textbook TOCTOU on the module-global struct alq *ath_hal_alq: unlocked consumers (if (ath_hal_alq) at sys/dev/netif/ath/ath_hal/ah_osdep.c:297, :336, :353 → alq_get(ath_hal_alq, …) at :264/:276) racing the sysctl disable path alq_close(ath_hal_alq); ath_hal_alq = NULL; (ah_osdep.c:230-232) yield a use-after-free write (alq_post through a freed struct alq). The code shape is certain (CWE-367, FreeBSD-inherited).

It is triple-dead on DragonFly:

1. AH_DEBUG_ALQ cannot be selected — its sys/conf/options mapping is commented out (sys/conf/options:551); config(8) rejects the option name.
2. The TU cannot compile even if force-defined — #include <sys/alq.h> is commented out (ah_osdep.c:202) and no alq(9) implementation or header exists anywhere in the tree (verified find sys -name "*alq*"; the other would-be consumers, ieee80211_alq.c / if_ath_alq.c, are themselves excluded from the build or guard alq calls behind the same dead option — if_ath_alq.c:51-53 has its alq include #ifdef'd empty for DF).
3. Second compile error inside the block — ALQ-branch ath_hal_reg_read calls ath_hal_reg_whilst_asleep() at ah_osdep.c:324, defined only under #ifdef AH_DEBUG (:153-171).

Guest evidence (DragonFly 6.5-DEVELOPMENT x86_64, ath compiled into GENERIC — hw.ath.* nodes live, ath_hal.ko not loaded, no Atheros PCI device):

• sysctl hw.ath.hal.alq / .debug / .alq_logfile → unknown oid (run.log) — the block is absent from the running kernel, as predicted.
• pciconf -l | grep -ciE "ath|1002" → 0 — no Atheros or AMD GPU hardware in the guest, so no runtime register traffic can be produced either.

Even on FreeBSD where this code builds, exploitation requires root to toggle hw.ath.hal.alq precisely while another CPU is between the NULL check and alq_get — a privileged-user-triggered race, not an unpriv path.

Verification honesty

• No escalation / panic was attempted on the guest because there is no compiled target and no hardware: every avenue ends at "code does not exist in the running kernel" (runtime-proven, not assumed).
• trigger.c documents the would-be reproducer shape (root sysctl toggler thread vs. register-traffic thread) and run.sh probes each precondition; on this guest all probes report ABSENT (exit 3).
• Classification: status untested, impact none on stock DF; filed as Info so the race is on record before anyone imports alq(9) and flips the option on wholesale.

Baseline vs fix validation

Not applicable — nothing reproduced, so there is no bad behavior to validate a fix against. fix.diff is a source-level hardening patch (delete the dead block) authored from the line-accurate analysis above; per audit rules it is NOT applied to sys/.

Production-active surface of ah_osdep.c (audited clean)

ath_hal_malloc M_ZERO|M_INTWAIT (ah_osdep.c:120-124 — zeroed, cannot fail, no uninit leak to HAL softcs) · ath_hal_vprintf→kvprintf with HAL-internal fmt (:132-136) · ether_sprintf DF per-CPU buffer (safe) · non-ALQ ath_hal_reg_write/reg_read (:378-424): optional serialise lock taken/released around the bus op + correct barrier placement (barrier-before-read, barrier-after-write) · SYSCTL_STRING logfile node: sizeof(kernelname) == MAXPATHLEN == sizeof(ath_hal_logfile) (sys/kern/kern_mib.c:178) → no write overflow · module glue serialized (:440-461).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.