mps_pci_free releases never-allocated IRQ resource panicking kernel on attach-failure paths
Summary
mps_pci_free (mps_pci.c:286-305) unconditionally calls bus_teardown_intr() and bus_release_resource() on sc->mps_irq[0]/sc->mps_intrhand[0] WITHOUT NULL guard. When mps_pci_attach fails at DMA-tag creation (220-232) or when mps_pci_setup_interrupts fails before bus_alloc_resource_any succeeds, mps_pci_free invoked with mps_irq[0]==NULL mps_irq_rid[0]==0. bus_teardown_intr(dev,NULL,NULL) harmless (pci.c:3389 guards irq==NULL) BUT bus_release_resource(dev,SYS_RES_IRQ,0,NULL) descends into resource_list_release (subr_bus.c:2721) which finds pre-populated legacy-INTx rid=0 entry added by pci_assign_interrupt (pci.c:2815) with rle->res==NULL -> panic("resource_list_release: resource entry is not busy") at subr_bus.c:2738-2739. Sibling mpr_pci.c hardened against exactly this via NULL-guarded mpr_pci_free_interrupts helper (mpr_pci.c:331-349); mps_pci.c was not. Attacker: root via kldload/kldunload mps.k or PCI hot-plug under hypervisor; preconditions MPS-supported SAS controller present (LSI SAS2004/2008/2108/2116/2208/2308/SSS6200) + attach fails at DMA-tag creation (realistic under global memory pressure). Impact: kernel panic -> full system crash local DoS. AV:L/AC:H/PR:H, A:H. Fix: gate IRQ teardown/release on sc->mps_irq[0]!=NULL mirroring mpr_pci.c.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2044 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source-confirmation verdict for DF-2044 | 628 B | ↓ raw |
| fix.diff | suggested-fix | Guard IRQ teardown/release with NULL check in mps_pci_free | 656 B | view raw |
| ../fix_build.log | build-log | Batch kernel build log (all fixes, rc=0) | 5.6 MB | ↓ download |
DF-2044 Verification Verdict
Severity: Low Impact class: panic Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)
Verdict: REPRODUCED (source-confirmed)
The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.
Fix: Guard IRQ teardown/release with NULL check in mps_pci_free
Fix applied and validated in batch kernel build (rc=0, -Werror).
Fix validation
All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build.
Build result: rc=0, 0 errors (full -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): mps_pci_free unconditionally calls bus_teardown_intr() and bus_release_resource() on sc->mps_irq[0]/sc->mps_intrhand[0] WITHOUT NULL guard; when attach fails early, NULL dere
Verified recommended fix
REPRODUCED (source-only): mps_pci_free unconditionally calls bus_teardown_intr() and bus_release_resource() on sc->mps_irq[0]/sc->mps_intrhand[0] WITHOUT NULL guard; when attach fails early, NULL deref panic.
Verdict
REPRODUCED (source-only): mps_pci_free unconditionally calls bus_teardown_intr() and bus_release_resource() on sc->mps_irq[0]/sc->mps_intrhand[0] WITHOUT NULL guard; when attach fails early, NULL deref panic.
No comments yet.