NULL-pointer dereference in mly_user_command error path when command pool exhausted
Summary
mly_user_command at mly.c:2883-2885: mly_alloc_command failure sets mc=NULL, goto out. Out path at :2935-2938: if(mc->mc_data!=NULL)kfree... then if(mc!=NULL)mly_release_command. NULL check on mc comes AFTER mc->mc_data deref -> NULL page read -> panic. Root only (/dev/mlyN mode 0600, :313). Trigger: flood 256+ concurrent MLYIO_COMMAND to exhaust pool. Fix: reorder checks - mc!=NULL first.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1288 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 912 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 838 B | view raw |
DF-1288 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
NULL-pointer dereference in mly_user_command error path when command pool exhausted
Source Location
sys/dev/raid/mly/mly.c:2883-2937
Verdict
Source-confirmed: NULL-pointer dereference in mly_user_command error path when command p. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
mly_user_command at mly.c:2883-2885: mly_alloc_command failure sets mc=NULL, goto out. Out path at :2935-2938: if(mc->mc_data!=NULL)kfree... then if(mc!=NULL)mly_release_command. NULL check on mc comes AFTER mc->mc_data deref -> NULL page read -> panic. Root only (/dev/mlyN mode 0600, :313). Trigger: flood 256+ concurrent MLYIO_COMMAND to exhaust pool. Fix: reorder checks - mc!=NULL first.
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: mly_user_command error path after mly_alloc_command failure: mc is uninitialized, subsequent deref causes NULL-deref. Complex fix. HW-gated.
Verified recommended fix
Source-confirmed: mly_user_command error path after mly_alloc_command failure: mc is uninitialized, subsequent deref causes NULL-deref. Complex fix. HW-gated.
Verdict
Source-confirmed: mly_user_command error path after mly_alloc_command failure: mc is uninitialized, subsequent deref causes NULL-deref. Complex fix. HW-gated.
No comments yet.