DF-2294 — FW_SBINDADDR / FW_CBINDADDR NULL d->ir dereference

Verdict (short)

REPRODUCED on the stock fwdev.o binary, both cited paths:

• FW_SBINDADDR (single open + single ioctl): fwb->sub = ir->dmach; (fwdev.c:617) loads from NULL + offsetof(struct fw_xferq, dmach) = 0x10 → Fatal trap 12: page fault, supervisor read, fw_ioctl ← dev_dioctl (panic.sbindaddr.txt).
• FW_CBINDADDR (two fds on the same controller): STAILQ_REMOVE( &ir->binds, fwb, ...) (fwdev.c:600) touches NULL + offsetof(struct fw_xferq, binds) = 0x38 → same fault (panic.cbindaddr.txt). FW_CBINDADDR only reaches the deref when fw_bindlookup() first finds an existing bind (fwdev.c:593-598 returns EINVAL otherwise), so the reproducer registers a legitimate bind on fd1 (SSTBUF+SRSTREAM+SBINDADDR — which itself requires d->ir != NULL on that fd) and then issues FW_CBINDADDR from fd2 whose d->ir is NULL.

Trigger is an operator-group user. Fix validated: NULL-check ir in both cases → EINVAL, no panic, and the legitimate bind/unbind path on a stream-equipped fd still works (fd1 of the A/B run).

Files

• poc_2294.c — trigger, both modes (sbind, cbind)
• panic.sbindaddr.txt (fault va 0x10), panic.cbindaddr.txt (0x38)
• run_fixed.log — fixed-kernel A/B
• fix.diff — combined fix (this finding: FW_CBINDADDR/FW_SBINDADDR NULL guards)
• fwharness.c/fwharness.h/fwhctl.c — verification harness (see ../DF-2293/ for the harness README)

DF-2294 VERDICT — REPRODUCED (panic, local DoS, operator-group user)

Chain (line-accurate, stock fwdev.o)

fw_ioctl (fwdev.c:410) takes ir = d->ir at fwdev.c:443 — NULL until a successful FW_SRSTREAM (fwdev.c:494). Neither bind ioctl checks it.

FW_SBINDADDR (fwdev.c:603-634)

612:    fwb = kmalloc(sizeof (struct fw_bind), M_FW, M_WAITOK);
613:    fwb->start = ((u_int64_t)bindreq->start.hi << 32) | bindreq->start.lo;
615:    fwb->end = fwb->start +  bindreq->len;
617:    fwb->sub = ir->dmach;            <-- ir == NULL: load at 0x10

Observed: Fatal trap 12: page fault, fault virtual address = 0x10, supervisor read data, page not present, fw_ioctl() at fw_ioctl+0x6eb ← dev_dioctl (panic.sbindaddr.txt). 0x10 == offsetof(struct fw_xferq, dmach) on this build — exactly the predicted NULL+offsetof dereference. Single open + single ioctl.

FW_CBINDADDR (fwdev.c:592-602)

593:    fwb = fw_bindlookup(sc->fc, bindreq->start.hi, bindreq->start.lo);
595:    if(fwb == NULL){ err = EINVAL; break; }   <-- guards only the miss
599:    STAILQ_REMOVE(&sc->fc->binds, fwb, fw_bind, fclist);
600:    STAILQ_REMOVE(&ir->binds, fwb, fw_bind, chlist);  <-- NULL+0x38

Reaching :600 requires a matching bind to exist, which (via the stock code) can only be registered by an fd whose own d->ir is set. The reproducer therefore uses two fds on the same controller: fd1 does the legit SSTBUF+SRSTREAM+SBINDADDR setup (real fw_bindadd, firewire.c:820), fd2 (fresh open, d->ir == NULL) issues FW_CBINDADDR → Fatal trap 12, fault virtual address = 0x38 (== offsetof(struct fw_xferq, binds)), fw_ioctl+0x429 (panic.cbindaddr.txt).

Both panics: uid=1002 opuser (operator group). No FireWire bus activity required.

Reachability honesty

Same as DF-2293: 0660 root:operator nodes exist only on systems with an OHCI controller (stock GENERIC compiles firewire but not fwohci). Verification used the verbatim-interposition harness; the faulting binary is the stock fwdev.o.

Fix validation (A/B, fix.diff FW_CBINDADDR/FW_SBINDADDR guards)

Patched kernel: * poc_2294 sbind → ioctl rc=-1 errno=22, no panic * poc_2294 cbind → fd1 setup still succeeds (legit bind path intact), fd2 FW_CBINDADDR → ioctl rc=-1 errno=22, no panic * guest alive.

Privesc assessment

None — NULL-offset load/store, deterministic fault → panic. Impact: dos. (The faulting write at &ir->binds in FW_CBINDADDR is a store to a fixed low address; on this kernel it simply faults — no controlled write primitive.)

Artifacts

panic.sbindaddr.txt, panic.cbindaddr.txt, run_fixed.log, poc_2294.c, fwharness.c (rig), env.txt.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.