⬢ DragonFlyBSD Kernel Audit
DF-3617 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
{
  "finding_id": "DF-3617",
  "title": "ath_intr TDMA/SWBA branch: unchecked TAILQ_FIRST(ic_vaps) and iv_tdma NULL dereference in hard interrupt context",
  "verdict_summary": "NULL-deref panic paths proven from source; require Atheros hardware (SWBA interrupt) to execute, absent on the audit guest. Config-ordering variant needs no race: sc_tdma outlives the TDMA vap (cleared only at sc_nvaps==0), so deleting the TDMA vap with a sibling vap remaining leaves a non-TDMA vap (iv_tdma==NULL) at the list head.",
  "reproduce": {
    "build": "n/a - hardware-interrupt path",
    "run": "on ath/TDMA hardware: create TDMA vap + second vap, destroy TDMA vap, wait for next SWBA",
    "expected": "NULL-deref kernel panic in ath_tdma_beacon_send / at vap->iv_tdma->tdma_bintval"
  },
  "kernel_refs": [
    "sys/dev/netif/ath/ath/if_ath.c:2186",
    "sys/dev/netif/ath/ath/if_ath.c:2188",
    "sys/dev/netif/ath/ath/if_ath.c:2190",
    "sys/dev/netif/ath/ath/if_ath.c:1855",
    "sys/dev/netif/ath/ath/if_ath_tdma.c:615",
    "sys/netproto/802_11/wlan/ieee80211_tdma.c:197"
  ],
  "artifacts": ["README.md", "VERDICT.md", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}