⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1944

afd_reinit frees softc without destroying disk cdev: orphan /dev/afd* NULL-deref/UAF on next I/O

Summary

afd_reinit L168-182 missing device: device_set_ivars(dev,NULL)+kfree(fdp)+return 1. Caller ata_reinit ata-all.c:218-244 calls device_delete_child->afd_detach which short-circuits ENXIO L140-141 because ivars NULL -> disk_destroy skipped cdev leaked live with si_drv1=dev. afd_strategy L233 fdp=device_get_ivars(dev)=NULL L258 lba=bio_offset/fdp->sectorsize NULL-deref panic or slab-reused UAF if M_AFD reclaimed. Sibling ad_reinit/acd_reinit correctly just return 1 letting detach handle cleanup. Same bug ast_reinit atapi-tape.c. Trigger: operator-group /dev/afd0 + media removal/channel reset IOCATAREINIT. Fix: return 1 without kfree let detach handle; defense-in-depth NULL guard in strategy/done.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1944 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 501 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1944 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/disk/nata/atapi-fd.c:168-258. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

nata atapi-fd IS in GENERIC. Source: afd_reinit at L168-182 missing device: device_set_ivars(dev,NULL)+kfree(fdp)+return 1. Caller ata_reinit calls device_delete_child->afd_detach which short-circuits ENXIO at L140-141 because ivars NULL → disk_destroy skipped, cdev leaked. Later open of /dev/afd* derefs NULL si_drv1.

Before NULLing ivars, call disk_invalidate/disk_destroy/devstat_remove_entry so the cdev is torn down cleanly.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1944/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Before NULLing ivars, call disk_invalidate/disk_destroy/devstat_remove_entry so the cdev is torn down cleanly. Full git-apply-able diff in findings/poc/DF-1944/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/disk/nata/atapi-fd.c:168-258. nata atapi-fd IS in GENERIC. afd_reinit L168-182 on missing device: device_set_ivars(dev,NULL)+kfree(fdp)+return 1. Caller ata_reinit calls device_delete_child->afd_detach which short-circuits ENXIO because ivars NULL -> disk_destroy skipped, cdev leaked. Later open of /dev/afd* derefs NULL si_drv1 -> panic. HW gated (no ATAPI floppy on guest).