DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2299

Missing NULL check on kmalloc return in fwdma_malloc_multiseg

Summary

fwdma_malloc_multiseg calls kmalloc(...M_WAITOK) and immediately dereferences return value (am->ssize=ssize at line 164) without checking for NULL. While DFly slab allocator currently panics rather than returns NULL for M_WAITOK this is latent defect that becomes NULL pointer dereference if allocation flags ever changed to include M_NULLOK or M_NOWAIT. When nseg driven very large by integer overflow (DF-2298) allocation size becomes enormous - slab limit check calls panic() producing DoS. Code contract is wrong.

Discussion (0)

No comments yet.