NULL-deref panic in twe_describe_controller: p[0] from twe_get_param not checked
Summary
twe_describe_controller at twe.c:1691-1697: p[0]=twe_get_param(DRIVESUMMARY) may return NULL. :1693 p[0]->data[i] derefs NULL without check. bootverbose path. Buggy/malicious HBA fails DriveSummary but returns valid PortCount. Fix: guard with if(p[0]!=NULL).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1428 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 775 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 2.5 KB | view raw |
DF-1428 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
NULL-deref panic in twe_describe_controller: p[0] from twe_get_param not checked
Source Location
sys/dev/raid/twe/twe.c:1691-1706
Verdict
Source-confirmed: NULL-deref panic in twe_describe_controller: p[0] from twe_get_param n. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
twe_describe_controller at twe.c:1691-1697: p[0]=twe_get_param(DRIVESUMMARY) may return NULL. :1693 p[0]->data[i] derefs NULL without check. bootverbose path. Buggy/malicious HBA fails DriveSummary but returns valid PortCount. Fix: guard with if(p[0]!=NULL).
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: twe_describe_controller p[0] from twe_get_param not NULL-checked before p[0]->data[i] deref, NULL-deref panic. Added NULL check + early return. HW-gated.
Verified recommended fix
Source-confirmed: twe_describe_controller p[0] from twe_get_param not NULL-checked before p[0]->data[i] deref, NULL-deref panic. Added NULL check + early return. HW-gated.
Verdict
Source-confirmed: twe_describe_controller p[0] from twe_get_param not NULL-checked before p[0]->data[i] deref, NULL-deref panic. Added NULL check + early return. HW-gated.
No comments yet.