⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1923

Detach loop indexes mem_res[] by slot position rather than slot->num: NULL-deref panic + resource leak after partial slot-init failure

Summary

sdhci_pci_attach L382-402 loop assigns sc->mem_res[i] for every iteration but only increments sc->num_slots on success. Partial failure (BAR alloc NULL or sdhci_init_slot fail): mem_res[k] NULL or allocated-but-orphaned num_slots not advanced so sc->slots[num_slots] on next success gets slot->num=k+1 not matching mem_res position. sdhci_pci_detach L431-437 walks i in [0,num_slots) and unconditionally derefs sc->mem_res[i] via rman_get_rid() which is raw ((r)->r_rid) deref. NULL mem_res[i] -> immediate kernel NULL-deref panic. Bounds check L350 slots>6||bar>5 permits bar=5 slots=6 for which bar+i ranges 5..10 PCIR_BAR(6..10) non-BAR config registers bus_alloc fails deterministically producing partial-failure state. Attacker: PCIe SDHCI device PCI_SLOT_INFO crafted bar=5 slots=6 (byte 0x65) or hot-unplug after partial init fail. Impact: reliable kernel panic DoS + resource leak. Fix: tighten bar+slots<=6; detach loop key off slot->num with NULL/bounds guard; release orphaned mem_res on init failure.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1923 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 663 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.6 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1923 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/disk/sdhci/sdhci_pci.c:350-436. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

sdhci IS in GENERIC but no SDHCI HW in guest. Source: sdhci_pci_attach loop assigns sc->mem_res[i] for every iteration but only increments sc->num_slots on success. Partial failure: mem_res[k]=NULL or allocated-but-orphaned (num_slots not advanced). sdhci_pci_detach then iterates for(i=0; i<num_slots; i++) indexing mem_res[i] which can be NULL → bus_release_resource(NULL) crashes.

Iterate for(i=0; i<6; i++) and skip NULL mem_res[], matching attach's BAR-slot indexing.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1923/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Iterate for(i=0; i<6; i++) in detach and skip NULL mem_res[], matching attach's BAR-slot indexing. Full git-apply-able diff in findings/poc/DF-1923/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/disk/sdhci/sdhci_pci.c:350-436. sdhci IS in GENERIC but no SDHCI HW in guest. sdhci_pci_attach L382-402 assigns sc->mem_res[i] for every iteration but only increments sc->num_slots on success. Partial failure: mem_res[k]=NULL or orphaned. sdhci_pci_detach iterates for(i=0; i<num_slots; i++) indexing mem_res[i] which can be NULL -> bus_release_resource(NULL) crashes. HW gated.