DF-5493 — uether_ifdetach() missing never-attached guard (class-wide owner)

status: reproduced / impact: panic / confidence: certain / fix validated

What

uether_ifdetach() (sys/bus/u4b/net/usb_ethernet.c:267-305) validates nothing about the struct usb_ether it is handed:

• usb_proc_drain() (:273) silently no-ops on an all-zero ue_tq (sys/bus/u4b/usb_process.c:409),
• uether_getifp() (:276, :133-137) returns the embedded arpcom ifnet, so the if (ifp != NULL) guard (:278) is dead code — always true,
• it then lockmgr()s through ue_lock (:281) and runs ether_ifdetach(ifp) (:294) unconditionally.

Eight drivers this pass (DF-5334/5384/5395/5397/5399/5411/5453/5486) call their detach — and thus uether_ifdetach() — on attach-failure paths where the ue was never attached. This file owns the class-wide defect and the central guard; the per-driver findings own each driver's goto detach.

Two failure arms verified on the guest

• Branch A (ue fields zero — all 8 sibling drivers' pre-uether_ifattach failures, e.g. if_cue.c:405-410): UE_LOCK(ue) → lockmgr(NULL) → Fatal trap 12, fault VA 0x0, Stopped at lockmgr_exclusive+0x5d (panic_a_serial.txt).
• Branch B (uether_ifattach() itself failed at usb_proc_create() ENOMEM, usb_ethernet.c:173-178; ue_lock valid, ue_tq unwound to zero by usb_process.c:217-219,244; every driver's if (uether_ifattach(ue)) goto detach; branch): ether_ifdetach() → if_down() on the never-if_attach()ed ifnet → Fatal trap 12, fault VA 0x0, Stopped at if_down_dispatch+0x66 (panic_b_serial.txt). Behind this crash also lurk sysctl_ctx_free() on a never-init'd ctx (:297) and devfs_clone_bitmap_put(..., ue_unit=0) of a never-allocated unit (:300) which would hand unit 0 to the next adapter while a live ue0 exists.

Rig (KLD harness + production code)

ue_guard_a.c / ue_guard_b.c: each kmallocs a zeroed struct usb_ether, constructs the exact post-failure state, and calls the production uether_ifdetach() from the stock auto-loaded uether.ko (MODULE_DEPEND(uether)). The failing call sites are static driver-attach paths needing a physical evil-USB device (or a taskqueue-creation ENOMEM), so state + call-sequence replay is the strongest runnable evidence — same evidence class as the 8 sibling rigs (see findings/poc/DF-5486/).

Build / run (in guest)

cd /root/df5493 && sh ./build.sh        # builds ue_guard_a.ko + ue_guard_b.ko, -Werror
sh ./run.sh a                           # baseline: Fatal trap 12 VA 0x0 (lockmgr NULL)
# (reset with-src, rebuild)
sh ./run.sh b                           # baseline: Fatal trap 12 VA 0x0 (if_down_dispatch)

With fix.diff applied to /usr/src, uether.ko rebuilt and installed, and the rigs rebuilt against the patched header, both branches print SURVIVED uether_ifdetach(), KLDLOAD_RC=0, traps: 0, clean unload (run_patched.log).

Fix

fix.diff: adds ue_attaching / ue_attached state flags to struct usb_ether; uether_ifattach() sets ue_attaching only after usb_proc_create() succeeds; ue_attach_post_task() sets ue_attached after publishing the ifnet; uether_ifdetach() early-returns on ue_lock == NULL || !ue->ue_attaching and gates the teardown block on ue->ue_attached (the failed-attach task already returned the unit). Covers branch A, branch B, and DF-2341's branch C (async PHY-probe attach failure) in one central place. git apply --check clean on the read-only tree.

VERDICT — DF-5493 (uether_ifdetach() missing class-wide never-attached guard)

status: reproduced / impact: panic / confidence: certain / fix: fixed

Root cause (line-accurate)

sys/bus/u4b/net/usb_ethernet.c:

• :267-305 uether_ifdetach() — no validation of the usb_ether state:
• :273 usb_proc_drain(&ue->ue_tq) no-ops on an all-zero ue_tq (sys/bus/u4b/usb_process.c:406-410 returns when up->up_lock == NULL).
• :276 ifp = uether_getifp(ue) returns &ue->ue_arpcom.ac_if (:133-137) — an embedded member, never NULL.
• :278 if (ifp != NULL) — dead guard, always true.
• :281 UE_LOCK(ue) = lockmgr(ue->ue_lock, LK_EXCLUSIVE) (:61) — branch A: ue->ue_lock == NULL → Fatal trap 12, fault VA 0x0.
• :294 ether_ifdetach(ifp) — branch B: ifnet never if_attach()ed → if_down()/if_detach() on a zeroed ifnet → Fatal trap 12, VA 0x0 (if_down_dispatch+0x66; deeper in, sys/net/if.c:975 ifindex2ifnet[0] = NULL and :982 TAILQ_REMOVE(&ifnetlist, ...) through a NULL tqe_prev).

• :297 sysctl_ctx_free() on a never-sysctl_ctx_init()ed ctx, :300 devfs_clone_bitmap_put(..., ue_unit=0) of a never-allocated unit (would double-issue "ue0") — latent behind the :294 crash.

• :161-189 uether_ifattach() returns error leaving ue_lock valid but ue_tq fully unwound to zero (usb_process.c:208-219 error path calls usb_proc_free() which resets up->up_lock = NULL at :244) and ue_attach_post_task never queued (queued only at :181-185 after success) — this is branch B's exact state.

Reachability (attacker model)

• Branch A: evil-USB / evil-dock / VM-attach — the 8 sibling findings (DF-5334 cdce, DF-5384 aue, DF-5395 axge, DF-5397 urndis, DF-5399 mos, DF-5411 udav, DF-5453 kue, DF-5486 cue) each proved a deterministic device-controlled attach failure reaching goto detach → uether_ifdetach() with a zeroed ue. All those driver modules are in the default module set and auto-load on device match.
• Branch B: any of the same 8 drivers when usb_proc_create() fails (kernel-thread/resource exhaustion — ENOMEM) — every driver has the error = uether_ifattach(ue); if (error) goto detach; branch.
• Fixed-address NULL derefs both arms (softc zeroed by newbus, sys/kern/subr_bus.c:1953 M_ZERO); no attacker-controlled data reaches the fault → local DoS from physical/VM USB access, no uid0 path. Same tier as the 8 siblings: Medium.

Evidence

• panic_a_serial.txt (baseline, stock uether.ko): 3 ue_guard_a: markers, ue_lock=0, Fatal trap 12, fault virtual address = 0x0, Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi, db> — guest dead.
• panic_b_serial.txt (baseline, stock uether.ko, fresh reset): ue_guard_b: markers with ue_lock=0xffffffff826001e0 ue_tq.up_lock=0, Fatal trap 12, VA 0x0, current process = Idle, Stopped at if_down_dispatch+0x66: movq (%rax),%r13 — the crash is inside ether_ifdetach()→if_down() on the never-attached ifnet, proving the call sequence survives UE_LOCK (:281) and usb_callout_drain (:286) and dies exactly at :294's teardown.
• run_patched.log (fix validation): after fix.diff applied in-guest, uether.ko rebuilt -Werror clean and installed, rigs rebuilt against the patched header: both branches print SURVIVED uether_ifdetach(), KLDLOAD_RC=0, traps: 0, UNLOAD_OK.
• build.log / build_b.log: -Werror clean builds of both rigs.
• fix.diff: git apply --check clean against the read-only sys/ tree; applied in-guest with patch -p1 (all 4 hunks, Plan A).

Rig honesty

The failing call sites (driver attach() statics; usb_proc_create ENOMEM) cannot be linked from a KLD — replaying the exact post-failure state + the single production uether_ifdetach() call (auto-loaded stock uether.ko) is the strongest runnable evidence, the same evidence class as the 8 sibling rigs this pass. One rig defect was caught and fixed during verification: CFLAGS+= -DBRANCH_A in a kmod Makefile is dropped by bsd.kmod.mk, so the first "branch A" binary actually contained branch B code (accidentally producing the first branch-B reproduction); rebuilt as two self-contained sources (ue_guard_a.c / ue_guard_b.c) with distinct module names and a cmp anti-identity check in build.sh.

Relationship to known findings

• Not DF-1082 (miibus device_t UAF via SIOCGIFMEDIA) — different code.
• Not DF-2341 (its branch C: ue_attach_post_task fails at mii_phy_probe/attach_post_sub → later ether_ifdetach crash) — same symptom sink, different trigger state; the central guard here additionally covers DF-2341's arm, and DF-2341's own per-arm handling is untouched. The 8 per-driver DF-5334-family findings own each driver's goto detach; this finding owns the missing central guard that would have neutralized the entire class in one place.

Pass-2 negative results (file checklist, all killed)

• (a) uether_ifattach partial-failure unwind: only failure is usb_proc_create (branch B); the taskqueue-drain-then-read-ifp ordering (:273→:276) is correct for the success path (drain waits for the async attach task).
• (b) uether_ifdetach ordering under concurrency: flag-clear under ue_lock (:281-283) precedes usb_callout_drain (:286); a watchdog racing in the window queues nothing (usb_proc_msignal drops on up_gone, usb_process.c:268-269) and its re-arm (:453) is stopped by the drain; ue_tick_task early-returns on the cleared IFF_RUNNING (:464). Method-table audit: all 10 drivers set every pointer the core derefs unconditionally (ue_attach_post :202, ue_setpromisc :394, ue_setmulti :404, ue_init :341, ue_stop :361, ue_start :383); mii-less tables (cdce/cue/ipheth/kue/urndis/udav_nophy) make the core skip mii_phy_probe (:230-231) so ue_ifmedia_task's unconditional ue_mii_upd (:437) is unreachable today (API hazard only, no finding).
• (c) uether_rxbuf (:589) clamps the destination (len < ETHER_HDR_LEN || len > MCLBYTES - ETHER_ALIGN) into a fresh MCLBYTES cluster — bounded. Source side usbd_copy_out (:598) is unbounded vs the page cache (usb_busdma.c:108 sets res.length = (usb_size_t)-1 for single-segment) but every live caller passes a constant offset (0 or 2) with len ≤ actlen ≤ bufsize. uether_rxmbuf (:563-578) has no clamp — filed as DF-5495 (Info); live instance is DF-5396 (urndis), other callers (cdce :1001/:1550, ipheth :498) are clamped.
• (d) Watchdog/queue machinery: ue_watchdog re-arm loop is bounded by the drain ordering above; ue_queue_command's post-msignal field writes are safe under the held ue_lock; start/stop tasks are synchronous via usb_proc_mwait (:129-130). uether_ifdetach never drains ue->ue_rxq — filed as DF-5494 (Low; cdce tr_stall at if_cdce.c:1014 skips the :1026 flush, mbufs leak with the softc).
• (e) Device-supplied sizes reaching the core: only via the rx entry points above — no new live unbounded path beyond DF-5396.

Fix validated

fix.diff (central): ue_attaching set in uether_ifattach() only after usb_proc_create() succeeds; ue_attached set in ue_attach_post_task() after the ifnet is published; uether_ifdetach() early-returns on ue_lock == NULL || !ue_attaching and gates the whole teardown block on ue_attached (the failed-attach task already returned its unit at :262). Applied in-guest, uether.ko rebuilt -Werror clean, installed, both baseline-panicking rigs re-run → SURVIVED, RC=0, 0 traps, clean unloads. Guest reset with-src after validation.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.