NULL dereference inside warning branch of cbb_cardbus_auto_open (rman_get_start(NULL))

• File: sys/dev/pccard/pccbb/pccbb.c
• Lines: 1028, 1029, 1030, 1031
• Severity: Info
• CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
• CWE: CWE-476 NULL Pointer Dereference
• Confidence: likely

Summary

The warning branch in cbb_cardbus_auto_open explicitly tests else if (rle->res == NULL) and then, inside that very branch, dereferences the NULL pointer by calling rman_get_start(rle->res) to format the warning message. If any code path ever inserts a cbb_reslist entry with a NULL res pointer, the kernel takes an immediate NULL-deref panic (local DoS).

Currently this path is dead code — cbb_insert_res (line 219) always sets rle->res = res from a non-NULL argument, and no other writer touches rle->res — but the defect is a loaded footgun: the explicit NULL check proves the author considered the possibility, and the deref inside it is unambiguously wrong.

Root cause

pccbb.c:1028 else if (rle->res == NULL) { followed by pccbb.c:1031 rle->type, rman_get_start(rle->res));.

rman_get_start dereferences its argument (it returns res->__r_i.rm_start or equivalent), so passing NULL is a guaranteed panic if reached.

Reachability today is nil because the only inserter, cbb_insert_res at line 219–222, unconditionally assigns rle->res = res after the res != NULL check in cbb_cardbus_alloc_resource (line 1185) and cbb_pcic_alloc_resource (line 1341).

The bug is classified Info/likely: the pattern is real and a maintainer touch (e.g., recording a placeholder resource, or failing through a partial-alloc path) would silently turn it into a kernel panic.

Threat

Local user.

Not currently reachable; would become a local kernel-panic DoS the moment any code path leaves an sc->rl entry with rle->res == NULL.

No privilege escalation or info leak.

Exploit / PoC

No current trigger — the bug is latent by virtue of cbb_insert_res's invariant. To demonstrate the defect once introduced, a kld that calls cbb_insert_res(sc, NULL, SYS_RES_MEMORY, rid) on a cbb_softc and then forces cbb_cardbus_auto_open would panic at pccbb.c:1031.

Not worth a runnable PoC today; the fix is the deliverable.

Recommended fix

Either remove the dead branch (rle->res can never be NULL given the inserter's contract) or, if the check is retained as defense-in-depth, do not dereference inside it:

--- a/sys/dev/pccard/pccbb/pccbb.c
+++ b/sys/dev/pccard/pccbb/pccbb.c
@@ -1027,9 +1027,9 @@ cbb_cardbus_auto_open(struct cbb_softc *sc, int type)
        if (rle->type != type)
            ;
        else if (rle->res == NULL) {
-           device_printf(sc->dev, "WARNING: Resource not reserved?  "
-               "(type=%d, addr=%lx)\n",
-               rle->type, rman_get_start(rle->res));
+           device_printf(sc->dev, "WARNING: Resource not reserved?  "
+               "(type=%d, rid=%x)\n",
+               rle->type, rle->rid);
        } else if (!(rman_get_flags(rle->res) & RF_ACTIVE)) {

Related findings

• DF-1488 (sibling): uninitialized prefetchable[] in same function.