⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1638

u_int16_t truncation of buffer size in ess_dmasetup/ess_dmapos causes busy-loop stall and kernel heap info leak when buffersize=65536

Summary

solo.c:769 ess_dmasetup cnt param u_int16_t; caller esschan_trigger:600 passes sndbuf_getsize() u_int32_t max 65536. 772 dmasz=cnt truncates 65536->0. 779 port_wr(vc,0x4,cnt-1,2)=0xFFFF correct DMA but driver notion=0. ess_dmapos:813 while(p>dmasz[ch-1]||...) becomes p>0 always true -> spin 1000*DELAY(10)=10ms under ess_lock + kprintf spam. 818 return dmasz-p = 0-p negative int -> esschan_getptr u32 huge. framework delta overcounts -> sndbuf_acquire marks uninitialized heap as ready -> read() leaks ~64KB kernel heap. DMA buffer bus_dmamem_alloc no BUS_DMA_ZERO. Trigger: hint.snd_solo.0.buffersize=65536 + /dev/dsp read. Fix: widen cnt to u32 + cap dmasz at 0xffff or special-case 64KB.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1638 · 4 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able fix for the cited bug 887 B view raw
VERDICT.md verdict source-confirmation analysis 704 B ↓ raw
build.sh build-script N/A (source-only) 61 B view raw
run.sh run-script N/A (source-only) 87 B view raw
VERDICT.md verdict source-confirmation analysis
↓ download raw

DF-1638 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: solo.c:769 ess_dmasetup cnt param u_int16_t; caller esschan_trigger:600 passes sndbuf_getsize() u_int32_t max 65536. 772 dmasz=cnt truncates 65536->0. 779 port_wr(vc,0x4,cnt-1,2)=0xFFFF correct DMA bu

Citation: sys/dev/sound/pci/solo.c:769-818

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: u_int16_t cnt truncation of 65536 buffer size to 0 (solo.c:769,600)

Verified recommended fix

Source-confirmed: u_int16_t cnt truncation of 65536 buffer size to 0 (solo.c:769,600)

Verdict

Source-confirmed: u_int16_t cnt truncation of 65536 buffer size to 0 (solo.c:769,600)