alc_attach checks stale error variable instead of resource pointer, NULL-deref on alloc failure
Summary
alc_attach() at if_alc.c:1348 initializes error=0 but checks it at :1363/:1484 after bus_alloc_resource_any() which returns NULL on failure and never writes to error. Both if(error!=0) guards are dead code. On failure, rman_get_bustag(NULL) at :1367 dereferences NULL resource -> kernel panic. Same for IRQ at :1482-1487. Reachable whenever rman cannot satisfy BAR/IRQ allocation (resource exhaustion, hot-unplug, PCI error). Fix: check sc->alc_res==NULL / sc->alc_irq==NULL, set error=ENXIO.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1206 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 715 B | view raw |
DF-1206 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
alc_attach checks stale error variable instead of resource pointer, NULL-deref on alloc failure
Source Location
sys/dev/netif/alc/if_alc.c:1361-1487
Verdict
Source-confirmed: alc_attach checks stale error variable instead of resource pointer, NU. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
alc_attach() at if_alc.c:1348 initializes error=0 but checks it at :1363/:1484 after bus_alloc_resource_any() which returns NULL on failure and never writes to error. Both if(error!=0) guards are dead code. On failure, rman_get_bustag(NULL) at :1367 dereferences NULL resource -> kernel panic. Same for IRQ at :1482-1487. Reachable whenever rman cannot satisfy BAR/IRQ allocation (resource exhaustion, hot-unplug, PCI error). Fix: check sc->alc_res==NULL / sc->alc_irq==NULL, set error=ENXIO.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: alc_attach checks stale error!=0 instead of sc->alc_res==NULL after bus_alloc_resource_any; dead guard causes NULL-deref on alloc failure. HW-gated.
Verified recommended fix
Source-confirmed: alc_attach checks stale error!=0 instead of sc->alc_res==NULL after bus_alloc_resource_any; dead guard causes NULL-deref on alloc failure. HW-gated.
Verdict
Source-confirmed: alc_attach checks stale error!=0 instead of sc->alc_res==NULL after bus_alloc_resource_any; dead guard causes NULL-deref on alloc failure. HW-gated.
No comments yet.