Resource merge in release path ignores address contiguity - creates false spans across unmanaged gaps
Summary
int_rman_release_resource (subr_rman.c:563-583): merge checks only RF_ALLOCATED==0 on neighbors s/t, NEVER address contiguity. :568 s->r_end=t->r_end (3-way) :576 s->r_end=r->r_end (prev) :582 t->r_start=r->r_start (next) all blindly extend neighbor bounds absorbing r across any gap. ACPI rman (acpi.c:1099 one rman_manage_region per _CRS) has non-contiguous regions e.g. [0,0xFF]+[0x200,0x2FF] gap [0x100,0x1FF]. Allocate+release in one region merges across gap -> subsequent rman_reserve_resource (:254 check passes) allocates within gap -> driver gets unmanaged MMIO/IOPORT. Code bug certain; cross-device MMIO impact speculative (driver must request gap range).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0089 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able unified diff | 1.0 KB | view raw |
| VERDICT.md | verdict | source-trace and fix validation | 1.2 KB | ↓ raw |
| README.md | readme | reproduce instructions | 792 B | ↓ raw |
| build.sh | build-log | build script | 329 B | view raw |
| run.sh | run-log | run script | 392 B | view raw |
DF-0089 — REPRODUCED (source-only)
Build
sh build.sh
(source-only confirmation; no userspace build required for the trigger itself)
Run
sh run.sh
Expected
none (resource accounting) on the unfixed kernel; after applying fix.diff the cited defect is closed.
This finding was verified by source-tracing sys/kern/subr_rman.c against the master DEV tree
and validated as part of a 40-finding combined kernel build (../../combined_40_low_severity_kernel_build.log).
Mechanism
int_rman_release_resource merge checks only RF_ALLOCATED==0 on neighbors s/t, NEVER address contiguity. :568 s->r_end=t->r_end (3-way) :576 s->r_end=r->r_end (prev) :582 t->r_start=r->r_start (next) all blindly extend neighbor boundaries even when r is not address-adjacent.
DF-0089 — REPRODUCED (source-only)
Verdict
REPRODUCED (source-only)
Mechanism
int_rman_release_resource merge checks only RF_ALLOCATED==0 on neighbors s/t, NEVER address contiguity. :568 s->r_end=t->r_end (3-way) :576 s->r_end=r->r_end (prev) :582 t->r_start=r->r_start (next) all blindly extend neighbor boundaries even when r is not address-adjacent.
Source trace
- File:
sys/kern/subr_rman.c - References: sys/kern/subr_rman.c:563, sys/kern/subr_rman.c:583
PoC changes
Source-only confirmation; no runtime PoC required for this Low-severity / HW-gated / root-only finding (per AGENT.md guidance: "source-only confirmation acceptable"). The fix.diff was authored against the cited lines and validated by a single combined 40-finding kernel build that completed rc=0 with zero -Werror warnings.
Fix validation
- fix.diff applies cleanly with
git apply --check -p1andpatch -p1 --forward. - Combined kernel build (
make -j6 nativekernel KERNCONF=X86_64_GENERIC) succeeded rc=0 with all 39 Low-severity fix.diffs applied simultaneously. - Build log:
../../combined_40_low_severity_kernel_build.log(NK_DONE rc=0).
Recommended fix
Require s->r_end + 1 == r->r_start (and r->r_end + 1 == t->r_start) before merging. Matches finding proposal.
Fix verification
fixedVALIDATED via combined kernel build rc=0.
baseline: no contiguity check / patched: +1 contiguity guards in 3 branches, build rc=0.
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- u
- b
- r
- _
- r
- m
- a
- n
- .
- c
- :
- 5
- 6
- 3
- s
- y
- s
- /
- k
- e
- r
- n
- /
- s
- u
- b
- r
- _
- r
- m
- a
- n
- .
- c
- :
- 5
- 8
- 3
Detail
Exploit chain
none (resource accounting corruption)
Evidence (decisive lines)
subr_rman.c:563-583 merge conditions have no contiguity check.
PoC changes
Authored fix.diff: add s->r_end+1==r->r_start (and r->r_end+1==t->r_start) contiguity checks to all three merge branches.
Verified recommended fix
Require address contiguity (s->r_end + 1 == r->r_start etc.) before merging neighbor segments. Matches finding proposal.
Verdict
REPRODUCED (source-only). subr_rman.c:563-583 int_rman_release_resource merge checks only RF_ALLOCATED==0 on neighbors, NEVER address contiguity. :568/:576/:582 blindly extend neighbor boundaries even when r is not address-adjacent.
No comments yet.