ast_reinit frees softc before ata_reinit calls ast_done/ast_detach -> NULL-deref panic on hot-unplug/reset
Summary
ast_reinit at 210-212 frees stp and NULLs ivars when drive gone after reset. ata_reinit (ata-all.c:218-244) then calls ata_finish(request) for in-flight (synchronous via ATA_STALL_QUEUE) -> ast_done derefs device_get_ivars(request->dev)=NULL at 482 then stp->flags at 490 &stp->stats at 493. Also device_delete_child calls ast_detach derefs NULL stp at 178 destroy_dev(stp->cdev1). ad_reinit (ata-disk.c:215) and acd_reinit (atapi-cd.c:217) correctly just return 1. afd_reinit (atapi-fd.c:168) has identical bug. Trigger: operator group /dev/ast0 write + hot-unplug or tape timeout. Panic. Fix: remove kfree+NULL from ast_reinit.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1787 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Remove kfree+NULL from ast_reinit; let detach path handle cleanup. | 626 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1787 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/disk/nata/atapi-tape.c:210-212.
Mechanism
ast_reinit frees stp and NULLs ivars when drive is gone; ata_reinit then calls ata_finish which derefs device_get_ivars(dev)=NULL in ast_done and ast_detach.
Fix
Remove kfree+NULL from ast_reinit; let detach path handle cleanup.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
nata module built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- n
- a
- t
- a
- /
- a
- t
- a
- p
- i
- -
- t
- a
- p
- e
- .
- c
- :
- 2
- 1
- 0
- -
- 2
- 1
- 2
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/disk/nata/atapi-tape.c:210-212. Fix compiled clean.
PoC changes
authored fix.diff: remove kfree+NULL+unused stp decl from ast_reinit
Verified recommended fix
Remove premature kfree+NULL from ast_reinit. Matches finding proposal.
Verdict
REPRODUCED (source-only). ast_reinit frees stp/NULLs ivars before ata_reinit calls ata_finish->ast_done derefs NULL ivars.
No comments yet.