⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1939

NULL-deref in siba_bwn_read_ivar SIBA_IVAR_PCICORE_REVID when hardware lacks detected PCI/PCIE core

Summary

siba_bwn_read_ivar L450-451 SIBA_IVAR_PCICORE_REVID *result=siba->siba_pci.spc_dev->sd_id.sd_rev no NULL guard. spc_dev assigned only when siba_scan finds PCI/PCIE core type matching host PCI capability siba_core.c:386-393; mismatch continues spc_dev stays NULL (softc zero-init). Driver family guards elsewhere siba_core.c:2785/2799/2811 if(spc_dev==NULL)return. Public accessor siba_pcicore_revid_get generated sibavar.h:82 any future child can call. No current consumer grep confirmed. Trigger: Broadcom SSB PCI device mismatched PCIe capability (QEMU/VFIO/passthrough); child calls pcicore_revid_get -> NULL deref -> panic. Fix: if(spc_dev==NULL)return ENOENT.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1939 · 4 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able fix for the cited bug 403 B view raw
VERDICT.md verdict source-confirmation analysis 713 B ↓ raw
build.sh build-script N/A (source-only) 61 B view raw
run.sh run-script N/A (source-only) 87 B view raw
VERDICT.md verdict source-confirmation analysis
↓ download raw

DF-1939 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: siba_bwn_read_ivar L450-451 SIBA_IVAR_PCICORE_REVID *result=siba->siba_pci.spc_dev->sd_id.sd_rev no NULL guard. spc_dev assigned only when siba_scan finds PCI/PCIE core type matching host PCI capabili

Citation: sys/dev/netif/bwn/siba/siba_bwn.c:450-451

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: spc_dev NULL deref in SIBA_IVAR_PCICORE_REVID (siba_bwn.c:450-451)

Verified recommended fix

Source-confirmed: spc_dev NULL deref in SIBA_IVAR_PCICORE_REVID (siba_bwn.c:450-451)

Verdict

Source-confirmed: spc_dev NULL deref in SIBA_IVAR_PCICORE_REVID (siba_bwn.c:450-451)