DF-4940 — if_ic: icoutput forces IFF_RUNNING and transmits without the up-path state machine

File: sys/dev/netif/ic/if_ic.c (icoutput, line 347) Verdict: REPRODUCED on the QEMU guest (state-machine corruption with two security-relevant consequences, both demonstrated), fix VALIDATED.

The bug

icoutput() begins with an unconditional ifp->if_flags |= IFF_RUNNING; (if_ic.c:347). ip_output() calls ifp->if_output() with no IFF_UP gate (sys/netinet/ip_output.c:698,742), and if_down() deletes no routes (sys/net/if.c:1818→if_down_dispatch, which only clears IFF_UP, purges the ifq and purges cloned routes — sys/netinet/in.c:1450 in_if_down). So any routed packet on a down ic0 executes the transmit path on an interface that never ran the up branch. Consequences:

1. ic0 is flagged RUNNING while DOWN. The next SIOCSIFFLAGS "up" sees IFF_UP && !IFF_RUNNING false (if_ic.c:188) and therefore skips both the buffer allocation and iicbus_request_bus() forever — on a never-allocated interface this sustains the DF-2001 NULL-deref state;
2. the packet is transmitted over the iicbus without if_ic owning the bus (ownership is only taken in icioctl; iicbus data transfers do not check sc->owner — sys/bus/iicbus/iiconf.c:298-311), corrupting any transfer in flight by the actual bus owner;
3. a subsequent SIOCSIFFLAGS "down" calls iicbus_release_bus() for a bus if_ic no longer owns; the parent-level release callback fires before the ownership check (iiconf.c:131-140) — a spurious controller-level release (benign with the stock null callback, but wrong).

Prerequisite

Same virtual-I2C-bridge harness as DF-4939 (lpbbfake.c, included) — no I2C hardware needed.

Build / Run

sh build.sh    # builds lpbbfake.ko on the guest
sh run.sh

Expected (unfixed kernel)

after ifconfig ic0 down:   flags=808810<POINTOPOINT,...>          (no RUNNING)
ping -c1 10.99.99.2        (TX while DOWN — netstat shows Opkts=1)
after ping:                flags=808850<POINTOPOINT,RUNNING,...>  (RUNNING forced while DOWN!)
ifconfig ic0 up            -> allocates NOTHING (devbuf 819 -> 819)
[control: normal down/up]  -> allocates 2 buffers (devbuf 819 -> 821)

With fix.diff (patched if_ic.ko)

ping -c1 10.99.99.2        -> "sendto: Network is down" (ENETDOWN)
flags after ping:          808810 (no phantom RUNNING)
ifconfig ic0 up            -> flags 808851 (proper UP+RUNNING); buffers reused (no leak, by DF-4939's fix)

Fix

Delete the forced ifp->if_flags |= IFF_RUNNING; and refuse to transmit unless the interface completed the up branch (UP+RUNNING and non-NULL buffers) — see fix.diff.

DF-4940 VERDICT — REPRODUCED (state-machine bypass in icoutput; contributes to DoS conditions)

Claim

sys/dev/netif/ic/if_ic.c:347: icoutput() unconditionally executes ifp->if_flags |= IFF_RUNNING;. Because (a) ip_output invokes ifp->if_output() with no IFF_UP gate (sys/netinet/ip_output.c:698,742), (b) if_down leaves routes installed (if.c:1818 → if_down_dispatch if.c:1730 only clears IFF_UP/purges ifq; in_if_down (in.c:1450) only purges cloned routes), and (c) the generic SIOCSIFFLAGS wrapper discards the driver's error return (if.c:2167-2171 ifp->if_ioctl(ifp, cmd, data, cred); — value dropped) — a single transmitted packet on a down (or never-properly-up) ic0 corrupts the interface state machine:

• RUNNING is set without iicbus_request_bus() and without buffer allocation (the up branch at if_ic.c:188-202 is then skipped forever because it requires !IFF_RUNNING);
• the transmit itself runs on an iicbus the driver does not own (data transfers never check sc->owner, iiconf.c:298-311 — only intr dispatch does, iiconf.c:50-51);
• a later SIOCSIFFLAGS down issues a spurious iicbus_release_bus() whose parent callback fires before the ownership check (iiconf.c:131-140).

On a system whose first "up" failed (bus busy: the wrapper still left IFF_UP set, if.c:2159-2160, and if_ic's own SIOCSIFADDR pre-sets IFF_UP at if_ic.c:176 before the fall-through), the forced RUNNING locks in the NULL ic_obuf/ic_ifbuf state — i.e. it permanently sustains the DF-2001 NULL-deref sinks (icoutput:358 bcopy, icintr:309 write). The NULL dereference itself is DF-2001 (pass 1, not re-reported here); this finding is the state-machine defect that creates and preserves the precondition through an ordinary data path.

Reproduction (guest, 2026-09-25, stock kernel)

Same harness as DF-4939 (lpbbfake.c → lpbb0 → iicbb0 → iicbus0 → ic0); transcript in run.log:

ifconfig ic0 10.99.99.1 10.99.99.2 netmask ... up     # proper up, buffers allocated
ifconfig ic0 down
ifconfig ic0 | head -1
  ic0: flags=808810<POINTOPOINT,SIMPLEX,MULTICAST,PROXY> ...   # no RUNNING
ping -c 1 -t 3 10.99.99.2
  1 packets transmitted, 0 received (100% loss)      # TX executed
netstat -I ic0  ->  Opkts 1                           # icoutput ran while DOWN
ifconfig ic0 | head -1
  ic0: flags=808850<POINTOPOINT,RUNNING,...>          # RUNNING FORCED while DOWN
vmstat -m; ifconfig ic0 up; vmstat -m
  devbuf 819 -> 819                                   # allocation SKIPPED (up branch bypassed)
# control (no intervening TX): ifconfig ic0 down; up
  devbuf 819 -> 821                                   # normal up allocates 2 buffers

Every element of the claim observed: phantom RUNNING while DOWN (flags 808810 → 808850), skipped allocation on the following up (819→819 vs control 819→821), and the transmit itself counted (Opkts=1) — i.e. it went out over an un-owned bus.

Impact

The demonstrated impact is kernel state corruption reachable from an unprivileged packet send once an administrator has configured the interface (or left it half-configured): phantom RUNNING, permanently skipped allocation/bus-acquisition, transmission without bus ownership (frame corruption against the real bus owner), spurious controller-level bus release. Combined with the (known, DF-2001) missing NULL guards it sustains a kernel NULL-deref panic state; combined with DF-4939's lifecycle it also interacts with the leak. Rated Low overall (needs if_ic hardware presence and admin configuration; direct memory-safety sinks are pass-1 findings), classified impact=dos for its ceiling.

Fix validation

fix.diff removes the forced flag and gates icoutput on UP|RUNNING + non-NULL buffers. Patched if_ic.ko (built together with the DF-4939 fix in one module; the two observables are independent) installed and rebooted:

ifconfig ic0 down; ping -c1 10.99.99.2
  ping: sendto: Network is down                       # ENETDOWN, packet dropped
ifconfig ic0 | head -1
  ic0: flags=808810<...>                              # NO phantom RUNNING
ifconfig ic0 up
  ic0: flags=808851<UP,POINTOPOINT,RUNNING,...>       # proper transition restored

Bad behavior GONE (transcript: run.log FIX section).

Kernel references

• sys/dev/netif/ic/if_ic.c:347 (forced IFF_RUNNING)
• sys/dev/netif/ic/if_ic.c:188-202 (up branch skipped once RUNNING is set)
• sys/dev/netif/ic/if_ic.c:176 (SIOCSIFADDR pre-sets IFF_UP before fall-through)
• sys/netinet/ip_output.c:698,742 (if_output called with no IFF_UP gate)
• sys/net/if.c:2134-2175 (wrapper pre-sets flags and discards driver error)
• sys/net/if.c:1730-1768 (if_down_dispatch deletes no routes)
• sys/netinet/in.c:1449-1453 (in_if_down purges cloned routes only)
• sys/bus/iicbus/iiconf.c:125-148 (release: parent callback before ownership check), :44-54 (intr dispatch to owner only)

Non-overlap statement

DF-2000 = SIOCSIFMTU free-vs-use race; DF-2001 = NULL derefs at icoutput:358 / icintr:309 pre-allocation (sink). This finding is the distinct icoutput state-machine defect (source line 347) that manufactures and preserves the conditions those sinks need; the sinks are cited, not re-claimed.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.