mfi_tbolt_alloc_cmd leaks lock and NULL-derefs sc->mfi_cmd_pool_tbolt on kmalloc failure
Summary
mfi_tbolt.c:471-480 error path frees slots + pool, sets sc->mfi_cmd_pool_tbolt=NULL, but NO return -> falls through to next loop iteration writing sc->mfi_cmd_pool_tbolt[i] = kmalloc() through NULL pointer. Also line 455 request_desc_pool = kmalloc(...) has NO NULL check but is derefed at 502. Trigger: memory pressure during mfi Thunderbolt attach (M_NOWAIT fails). Fix: return 1 from error path + check request_desc_pool NULL.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1583 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 270 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 708 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1583 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: mfi_tbolt.c:471-480 error path frees slots + pool, sets sc->mfi_cmd_pool_tbolt=NULL, but NO return -> falls through to next loop iteration writing sc->mfi_cmd_pool_tbolt[i] = kmalloc() through NULL po
Citation: sys/dev/raid/mfi/mfi_tbolt.c:455-480
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: missing return after freeing pool — falls through writing NULL[i] (mfi_tbolt.c:471-480)
Verified recommended fix
Source-confirmed: missing return after freeing pool — falls through writing NULL[i] (mfi_tbolt.c:471-480)
Verdict
Source-confirmed: missing return after freeing pool — falls through writing NULL[i] (mfi_tbolt.c:471-480)
No comments yet.