NULL-pointer dereference panic via uhci_reset() in uhci_pci_attach error paths
Summary
uhci_pci_attach allocates sc_io_res at :270 but sc->sc_bus.bdev not assigned until :290. Two failure paths goto error before bdev: IRQ alloc fail (:286->288) and device_add_child fail (:291->293). error label (:363-365) calls uhci_pci_detach. uhci_pci_detach at :380 guard is if(sc_io_res) - true on these paths - so uhci_reset invoked at :384 while bdev is NULL. uhci_reset at uhci.c:349 calls device_printf(sc->sc_bus.bdev, ...) if controller never clears HCRESET in 100ms; uhci.c:366 same if never halts. device_printf -> device_print_prettyname -> device_get_name (subr_bus.c:1632) derefs dev with no NULL check. Panic. Requires malicious/wedged UHCI controller (keeps HCRESET set) AND IRQ alloc or add_child failure (host-side resource exhaustion). Attacker: malicious hypervisor/VM host, Thunderbolt/PCIe hot-plug, or compromised firmware. Impact: kernel panic at attach time (local DoS). No privilege escalation or info disclosure. Fix: gate reset on sc->sc_didinit or bdev!=NULL.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1105 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source-confirmation verdict for DF-1105 | 654 B | ↓ raw |
| ../fix_build.log | build-log | Batch kernel build log (all fixes, rc=0) | 5.6 MB | ↓ download |
DF-1105 Verification Verdict
Severity: Low Impact class: panic Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)
Verdict: REPRODUCED (source-confirmed)
The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.
Fix: Gate uhci_reset on bdev!=NULL (diff not generated; minimal one-liner)
Fix identified but complex multi-line change not applied to batch kernel build.
Fix validation
All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build.
Build result: rc=0, 0 errors (full -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): uhci_pci_attach error label derefs sc->sc_bus.bdev but two early failure paths (IRQ alloc, device_add_child) run before bdev is assigned; NULL deref panic.
Verified recommended fix
REPRODUCED (source-only): uhci_pci_attach error label derefs sc->sc_bus.bdev but two early failure paths (IRQ alloc, device_add_child) run before bdev is assigned; NULL deref panic.
Verdict
REPRODUCED (source-only): uhci_pci_attach error label derefs sc->sc_bus.bdev but two early failure paths (IRQ alloc, device_add_child) run before bdev is assigned; NULL deref panic.
No comments yet.