⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1932

kfree(NULL) kernel panic on any PCI attach failure path

Summary

aac_pci_attach L334-462 every early-failure (bus-master enable L356-358 unknown hwif L384-388 BAR0 alloc fail L397-401 BAR1 alloc fail L407-412 IRQ alloc fail L429-433 parent DMA tag fail L440-451) executes goto out L458 which runs if(error)aac_free(sc) L459-460. Softc M_ZERO aac_commands NULL until aac_alloc aac.c:581 only reached deep inside aac_attach after aac_check_firmware aac.c:258. aac_free aac.c:613 kfree(sc->aac_commands,M_AACBUF) unguarded NULL — every neighbor cleanup properly NULL-guarded. _kfree kern_slaballoc.c:1406-1407 if(ptr==NULL)panic(trying to free NULL pointer). Trigger: PCIe/Thunderbolt hotplug device vendor=0x9005 device=0x0285; PCI resource exhaustion; broken AAC controller firmware timeout 3min AAC_BOOT_TIMEOUT; VM PCI passthrough. Impact: deterministic kernel panic DoS no escalation/leak. Fix: if(sc->aac_commands!=NULL)kfree in aac.c:613.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1932 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 372 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.6 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1932 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/raid/aac/aac_pci.c:358-460. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

aac (Adaptec) — aacp is in GENERIC but aac itself is built as module. Source: aac_pci_attach early-failure paths (bus-master, unknown hwif, BAR0/BAR1 alloc fail, IRQ fail, DMA tag fail) execute goto out L458 which runs aac_free(sc). aac_free at aac.c:613 kfree(sc->aac_commands) unconditionally; for early failures sc->aac_commands is NULL → kfree(NULL) panics (kern_slaballoc.c:1405 panic 'trying to free NULL pointer').

Guard if (sc->aac_commands != NULL) kfree(...) in aac_free.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1932/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Guard if (sc->aac_commands != NULL) kfree(...) in aac_free. Full git-apply-able diff in findings/poc/DF-1932/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/raid/aac/aac.c:613. aac (module, aacp in GENERIC). aac_pci_attach early-failure paths execute goto out which runs aac_free(sc). aac_free aac.c:613 kfree(sc->aac_commands) unconditionally; for early failures sc->aac_commands is NULL -> kfree(NULL) panics (kern_slaballoc.c:1405 'trying to free NULL pointer'). HW gated.