DF-1262
dsp_mmap (legacy d_mmap) performs unbounded vtophys() on user offset (dead code, latent critical)
Summary
dsp_mmap at dsp.c:2287-2293: offset=a_offset (raw user), a_result=atop(vtophys(offset)), return 0. Unbounded translation of arbitrary kernel VA to physical page -> would expose kernel memory if reached. Currently DEAD CODE: dsp_ops also has d_mmap_single (:2296) which takes precedence in vm_mmap.c. Only fires if d_mmap_single removed in refactor. Fix: delete dsp_mmap entirely.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1262 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 390 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/sound/pcm/dsp.c:2287: dsp_mmap performs unbounded vtophys() on user offset (dead code, latent critical)
Verified recommended fix
Source-confirmed at sys/dev/sound/pcm/dsp.c:2287: dsp_mmap performs unbounded vtophys() on user offset (dead code, latent critical)
Verdict
Source-confirmed at sys/dev/sound/pcm/dsp.c:2287: dsp_mmap performs unbounded vtophys() on user offset (dead code, latent critical)
No comments yet.