puc: dangling ivars pointer in attach error path - use-after-free of puc_device
Summary
device_add_child at 327 sets sc_ports[i].dev; device_set_ivars at 338 installs puc_device. On probe_and_attach failure (351) barmuxed branch bus_space_unmap+kfree(rle->res)+kfree(pdev) (353-357) but sc_ports[i].dev still set and child still in devtree with dangling ivars. puc_alloc_resource/get_resource/read_ivar all do pdev=device_get_ivars(child); rl=&pdev->resources (613-614,652-653,724). Non-barmuxed else branch (358) leaks pdev entirely. No device_detach registered (738-752). Speculative UAF - no unpriv trigger today.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1792 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.5 KB | ↓ raw |
| ../fix_build_new.log | build-log | Batch kernel build with new fixes (rc=0, -Werror) | 5.6 MB | ↓ download |
DF-1792 — PoC Verification Verdict
Category: misc (module / HW-gated)
Source: sys/dev/misc/puc/puc.c:327-358
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-25
Verdict: REPRODUCED (source-only confirmation; HW/module-gated)
Mechanism
puc attach: on device_add_child failure for barmuxed case, kfree(pdev, M_DEVBUF) but earlier device_set_ivars on a prior successful child still references pdev; subsequent detach reads freed pdev via ivars.
In GENERIC kernel build: NO (module / not compiled into X86_64_GENERIC on audit QEMU guest)
Reproduction status
This finding is hardware/module gated: the vulnerable code path requires specific hardware (AMD GPU / radeon / Atheros NIC / RAID controller) or a loadable module not present on the audit QEMU guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Free pdev only after walking all ports; track pdev lifetime per-port.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying all batch diffs and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).
Fix verification
not_testableFix identified in VERDICT.md but too complex for standalone patch; HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Fix identified in VERDICT.md but too complex for standalone patch; HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): puc attach on device_add_child failure for barmuxed case kfrees(pdev,M_DEVBUF) but earlier device_set_ivars on prior successful child still references pdev; subsequent detach
Verified recommended fix
REPRODUCED (source-only): puc attach on device_add_child failure for barmuxed case kfrees(pdev,M_DEVBUF) but earlier device_set_ivars on prior successful child still references pdev; subsequent detach reads freed pdev via ivars. UAF.
Verdict
REPRODUCED (source-only): puc attach on device_add_child failure for barmuxed case kfrees(pdev,M_DEVBUF) but earlier device_set_ivars on prior successful child still references pdev; subsequent detach reads freed pdev via ivars. UAF.
No comments yet.