DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2388

Detach does not drain in-flight ACPI notifies (AcpiOsWaitEventsComplete no-op on DragonFly) - DF-2381 class

Summary

acpi_panasonic_detach() calls AcpiRemoveNotifyHandler() then frees sysctl context returns. On DragonFlyBSD AcpiOsWaitEventsComplete() defined as empty no-op so AcpiRemoveNotifyHandler does NOT wait for notify dispatch already in flight on another thread. Same DF-2381-class defect present in every sibling acpi_* hotkey driver. In THIS specific driver does not produce demonstrable UAF: device_t and softc persist after detach (orphaned ACPI-bus children until device destruction) in-flight notify path dereferences only sc->dev and sc->handle which remain valid. Residual risk is logic/ordering hazard not memory-corruption UAF.

Discussion (0)

No comments yet.