DF-5740 — hci_socket.c sockbuf mutation from the NETISR thread (hci_mtap sbappendaddr / hci_drop sbdroprecord) + post-detach hci_drop UAF

Production code: sys/netbt/hci_socket.c (md5 50bdf81bf0b8828ce1336511b98e3c52, compiled VERBATIM into the rig; see setup.log).

What this pack contains

• harness.c, sock_stub.c, stub.h, Makefile, build.sh — the production-code KLD rig ("hci_sock_harness"): compiles hci_socket.c / hci_event.c / hci_link.c / hci_misc.c / hci_unit.c / bt_input.c / bt_proto.c unmodified, registers the real AF_BLUETOOTH domain (so plain userland socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) exercises production hci_sattach/hci_ssend/ hci_sdetach), attaches a fake controller unit via production hci_attach() with hci_num_cmd_pkts = 0, and injects Command_Complete events through production hci_input_event() from a kernel thread pinned to CPU 3.
• trigger.c — userland: opens N promiscuous full-filter tap sockets (with SO_HCI_DIRECTION to widen the per-copy window), then loops {open HCI socket, raise SO_SNDBUF, connect(unit), send K commands, drain taps, close}. Optional DF5740_FEEDER=1 adds a second open/send/close thread to multiply freed-socket-slot reuse.
• run.sh — the exact orchestration (load, setup, baseline, race).
• panic.txt — the decisive panic: receive 1 backtrace + earlier crash/wedge evidence.
• race3/4/5.log, fix_run.log — trigger-side outputs.
• build.log, setup.log, env.txt, code_hashes.txt.
• fix.diff — the verified fix (sockbuf tokens + ctx-owned socket reference + devlock-guarded ctx consume).

Build (inside the guest, as root)

sh build.sh          # copies /usr/src/sys/netbt/*.c VERBATIM (md5s in
                     # setup.log), builds hci_sock_harness.ko + trigger

Run (inside the guest, as root)

kldload ./hci_sock_harness.ko
sysctl hw.hsh_setup=1                    # attach unit + CPU3 injector
sysctl debug.trace_on_panic=1 debug.debugger_on_panic=0
# race:
sysctl hw.hsh_fire=99999 &               # paced completion flood, cpu3
DF5740_FEEDER=1 ./trigger 8000 6 200     # open/send/close + taps, any cpu

Expected result (unfixed production code)

Kernel panic panic: receive 1 in soreceive() (sockbuf accounting desync between hci_mtap's sbappendaddr on the netisr port and the user thread inside soreceive) — observed at 24 s on the rig — or, on production (non-KASSERT) kernels, silent sockbuf corruption: lost records with live ssb_cc (permanent sosend/soreceive stalls — race5.log shows 96 non-EWOULDBLOCK send failures accumulating), stale sb_lastrecord writes into freed mbufs, record theft from reallocated sockets (the post-detach hci_drop() UAF), mbuf double-frees, and hard system wedges (race4.log, race5.log, send_ipiq ... tgt not draining in panic.txt).

Expected result (with fix.diff applied to /usr/src/sys/netbt and the

rig rebuilt — identical race load)

No panic, no wedge, zero send failures; the run survives ≥4× the exposure that panicked the unfixed kernel (fix_run.log: 425+ iterations clean vs baseline panic at ~100–150 iterations, stopped manually). fix.diff was validated exactly this way.

DF-5740 — VERDICT

Finding: sys/netbt/hci_socket.c mutates socket buffers from the NETISR thread with no synchronization, and hands the TX-completion callback (hci_drop) a raw socket pointer with no reference.

Three coupled defects, one root cause family — hci_socket.c touches sockets from whatever CPU/netisr port processes controller traffic, while every socket op (send/close) is serialized on a different port (netisr_cpuport(0), uipc_socket.c:259):

1. RX side (demonstrated panic) — hci_mtap() (hci_socket.c:1003-1010) calls sbappendaddr(&so->so_rcv.sb, ...) + sorwakeup() from btintr on the queueing CPU's netisr port, holding neither ssb_lock nor ssb_token. A user thread in soreceive() (uipc_socket.c:1320) holds ssb_token+ssb_lock, which do not exclude the netisr appender. Torn interleavings desynchronize ssb_mb from ssb_cc. Reproduced: INVARIANTS kernel panicked in 24 s with panic: receive 1 (uipc_socket.c:1348: KASSERT(m != NULL || !ssb_cc)) — soreceive()+0xd1f via sys_recvfrom, cpu4, while cpu3 ran the completion flood (panic.txt). On production kernels the same interleave silently corrupts (see 3).

2. TX side, live socket — hci_send() appends the "precious" record with sbappendrecord on cpu0's port (hci_socket.c:522) while hci_drop() drops it with sbdroprecord/sowwakeup (hci_socket.c:437-438) from the completion cpu's port (hci_unit.c:505-507). Neither takes the sockbuf token; sbdroprecord's own contract ("must be called while holding a critical section", uipc_sockbuf.c:510-512) is violated cross-CPU. race5.log shows the damage accumulating as non-EWOULDBLOCK send failures (96 by iter 875) on the raced so_snd.

3. TX side, dying socket (UAF) — the completion context is stored as a raw pointer in the mbuf (M_SETCTX(m, so), hci_socket.c:523) with no reference. hci_sdetach() tries to defuse it with hci_cmdwait_flush() (hci_socket.c:446-465), but that sweep only sees mbufs still in unit->hci_cmdwait: any command mbuf already dequeued by the concurrent completion path (hci_event.c:282/354 → hci_output_cmd hci_unit.c:490-509, which reads the ctx at :505 after a long hci_mtap walk over every listening socket) is invisible to it. After the sweep, detach sets so_pcb = NULL, sofree() (hci_socket.c:573-574) drops the last reference → ssb_release→sbflush frees the pending so_snd records and sodealloc frees the socket (uipc_socket.c:380-437). The completion cpu then executes hci_drop(freed_so) → sbdroprecord(&freed->so_snd.sb) + m_freem() of the already freed record chain (double free) + sowwakeup(freed), or — when the objcache slot was already recycled into the next socket the trigger opens — steals and frees an unrelated live socket's records. I could not capture this exact interleaving in a stand-alone panic: on non-reused slots sbflush has already NULLed sb_mb, so the stale drop is a silent no-op; the observable forms (record theft desyncs, double frees, the cpu0 wedge of race2/4/5) are all present in the logs. Mechanism verified line-by-line; the code holds no reference and the flush sweep is TOCTOU by construction.

Honest confound: race1/2's page-fault panic (hci_input_event+0x42, NULL m) was enabled by DF-5742's unbounded tap exhausting the mbuf pool under my non-draining taps; it is a rig artifact (m_gethdr NULL + no-op KKASSERT in the kmod + _m_copyback2(NULL) returning success) and is NOT claimed as this finding's proof. The proof is the panic: receive 1 run (race6) whose taps drained.

Reproduced: yes (panic + corruption + wedge under race load). Impact: kernel memory corruption (sockbuf list/accounting desync, mbuf double-free, cross-socket record theft, UAF write into freed/reallocated struct socket); panic on INVARIANTS kernels, hard hangs (cpu wedge) otherwise. Not driven to uid=0: the corrupted objects are mbuf chains and socket slots; a full chain would need objcache grooming of the recycled socket slot and control over the stolen record's reuse — plausible but not completed in this run. Threat model: unprivileged local user on any machine with a Bluetooth controller (raw HCI sockets are unprivileged; the attacker supplies both the tap/recvfrom side and the command traffic; with DF-5741 every socket is "privileged" anyway).

Fix validated: fix.diff (sockbuf tokens around all four mutation sites, ctx-owned socket reference via soreference/sofree, and a hci_devlock-guarded single-consumer consume of the ctx shared by hci_output_cmd and hci_cmdwait_flush). Applied to the guest's /usr/src, rig rebuilt (build.sh copies the patched files verbatim), identical race re-run: 425+ iterations / 85k+ commands queued / 0 send failures / no panic / no wedge vs baseline panic at ~100-150 iterations (fix_run.log), then stopped manually. Baseline vs patched recorded.

Key kernel refs - sys/netbt/hci_socket.c:1003-1010 (mtap append, no token) - sys/netbt/hci_socket.c:433-439→fix (drop, no token/no ref) - sys/netbt/hci_socket.c:446-465 (flush TOCTOU) - sys/netbt/hci_socket.c:522-523 (append + M_SETCTX, no ref) - sys/netbt/hci_socket.c:567-579 (detach: flush, so_pcb=NULL, sofree) - sys/netbt/hci_unit.c:494-509 (output_cmd: mtap window, ctx read) - sys/netbt/hci_event.c:281-284,353-356 (cmdwait drain, netisr port) - sys/kern/uipc_socket.c:259 (so_port = netisr_cpuport(0)) - sys/kern/uipc_socket.c:1348 (the KASSERT that fired) - sys/kern/uipc_sockbuf.c:510-512 (sbdroprecord critical-section contract)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.