kern/60485: pf(4): uaf in fragment reassembly

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60485
>Category:       kern
>Synopsis:       pf(4): uaf in fragment reassembly
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 23 17:15:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The UafPF Foundation, Inc.
>Environment:
>Description:

	pf(4) fragment reassembly may lead to use-after-free of a pf
	mbuf tag.

   5759 	if ((pf_mtag = pf_get_mtag(m)) == NULL) {
...
   5762 		return (PF_DROP);
   5763 	}
...
   5771 	/* We do IP header normalization and packet reassembly here */
   5772 	if (pf_normalize_ip(m0, dir, kif, &reason, &pd) != PF_PASS) {
   5773 		action = PF_DROP;
   5774 		goto done;
   5775 	}
   5776 	m = *m0;	/* pf_normalize messes with m0 */
...
   5969 		pf_mtag->flags |= PF_TAG_TRANSLATE_LOCALHOST;

https://nxr.netbsd.org/xref/src/sys/dist/pf/net/pf.c?r=1.87#5758

	pf_normalize_ip can change the identity of *m0, so the pf_mtag
	previously obtained from m may have been freed.

	Forwarded to us by Chris Jarrett-Davies <chrisjd%openai.com@localhost>.

>How-To-Repeat:

	1. configure pf to reassemble fragments
	2. send fragments

	(turn on asan or whatever to actually detect it)

>Fix:

	Re-acquire pf_mtag from the replacement mbuf.