puc: NULL-deref kernel panic in puc_config_superio when BAR 0 fails to allocate
Summary
puc_config_superio at 446 puc_config_win877(sc->sc_bar_mappings[0].res) unconditional no NULL guard. BAR 0 alloc loop 243-271 tolerates failure: if(res==NULL){continue;} leaves sc_bar_mappings[0].res==NULL (softc bzero at 214). puc_config_win877 at 495 rman_get_bustag(res)/rman_get_bushandle(res) -> bus_space_write_1 deref NULL/corrupt tag. Syba SD-LAB card vendor 0x1592 product 0x0781. PCI hotplug/passthrough with unsatisfiable BAR 0. Panic DoS. Fix: guard res==NULL before puc_config_win877.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1791 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Guard res==NULL before calling puc_config_win877. | 415 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1791 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/misc/puc/puc.c:446.
Mechanism
puc_config_superio calls puc_config_win877(sc->sc_bar_mappings[0].res) without NULL guard; BAR 0 alloc loop tolerates failure leaving res==NULL, rman derefs NULL tag/handle.
Fix
Guard res==NULL before calling puc_config_win877.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0 (puc.c is optional config driver).
Batch build rc=0, 0 errors.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- m
- i
- s
- c
- /
- p
- u
- c
- /
- p
- u
- c
- .
- c
- :
- 4
- 4
- 6
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/misc/puc/puc.c:446. Fix compiled clean in batch build (optional puc driver).
PoC changes
authored fix.diff: guard res==NULL before win877 call
Verified recommended fix
Add NULL guard for res before puc_config_win877. Matches finding proposal.
Verdict
REPRODUCED (source-only). puc_config_win877 called with res==NULL (BAR 0 alloc failure tolerated); rman derefs NULL tag/handle.
No comments yet.