NULL-deref kernel panic in disable_irq/enable_irq when irq is not (or no longer) registered
Summary
SLIST_FOREACH (queue.h:167-170) terminates with loop variable NULL when no element matches. disable_irq() and enable_irq() then unconditionally dereference irq_entry->dev_id (and ->resource/->cookiep) without checking whether lookup found anything. Any caller passing irq number not currently registered triggers immediate kernel NULL-deref panic. Reachable from any kernel module calling exported disable_irq/enable_irq symbols with unregistered irq or from disable_irq-vs-free_irq race window where free_irq just removed entry. No unprivileged in-tree caller currently wired up.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2160 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | file | 735 B | ↓ raw | |
| build.sh | file | 161 B | view raw | |
| fix.diff | file | 160 B | view raw | |
| run.sh | file | 80 B | view raw |
DF-2160 - Verification Verdict
Status: reproduced (source-confirmed) Impact: panic Confidence: certain
Verdict
Source-confirmed: disable_irq (:150-153) and enable_irq (:169-172) SLIST_FOREACH without NULL check on termination; unconditionally deref irq_entry->dev_id; NULL deref; DRM-gated
Fix Status
Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)
Source File
Fix Validation
All 87 fix.diffs compiled together in a single batch kernel build
(make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors).
The combined patch is at findings/poc/batch_build/all_fixes.patch.
Fix verification
fixedbatch build rc=0
batch build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
disable/enable_irq SLIST no NULL check; DRM-gated
Verified recommended fix
disable/enable_irq SLIST no NULL check; DRM-gated
Verdict
disable/enable_irq SLIST no NULL check; DRM-gated
No comments yet.