DF-0086
dev_dopen dereferences inner *a_fpp without NULL check (latent panic, no current trigger)
Summary
dev_dopen (kern_device.c:151-152): if(ap.a_fpp) (*ap.a_fpp)->f_data=vp guards outer ptr-to-ptr but derefs inner *a_fpp unconditionally. If caller passes non-NULL a_fpp whose pointed-to struct file* is NULL -> NULL deref panic. No in-tree trigger: vn.c passes a_fpp=NULL (:586/:660), devfs open forwards from vn_open which already allocated struct file. Latent hardening gap for future callers. Fix: add && *a_fpp!=NULL.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0086 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | dev_dopen dereferences inner *a_fpp without NULL check (latent panic, no current | 284 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_device.c:151: dev_dopen derefs inner *a_fpp without NULL check (latent)
Verified recommended fix
Source-confirmed at sys/kern/kern_device.c:151: dev_dopen derefs inner *a_fpp without NULL check (latent)
Verdict
Source-confirmed at sys/kern/kern_device.c:151: dev_dopen derefs inner *a_fpp without NULL check (latent)
No comments yet.