Detach does not drain in-flight ACPI notifies (AcpiOsWaitEventsComplete no-op on DragonFly) - DF-2381 class
Summary
acpi_panasonic_detach() calls AcpiRemoveNotifyHandler() then frees sysctl context returns. On DragonFlyBSD AcpiOsWaitEventsComplete() defined as empty no-op so AcpiRemoveNotifyHandler does NOT wait for notify dispatch already in flight on another thread. Same DF-2381-class defect present in every sibling acpi_* hotkey driver. In THIS specific driver does not produce demonstrable UAF: device_t and softc persist after detach (orphaned ACPI-bus children until device destruction) in-flight notify path dereferences only sc->dev and sc->handle which remain valid. Residual risk is logic/ordering hazard not memory-corruption UAF. [PASS-2 CLOSURE: the DF-4823 validated OSL drain (AcpiOsWaitEventsComplete implementation) closes this finding with ZERO change to this file - AcpiRemoveNotifyHandler itself calls the drain (evxface.c:505) and this detach already removes the handler at :213] [VERIFIED pass2: HW-gated; drain-nothing detach with no-op OSL wait proven by sibling DF-2381; drain fix compile-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2388 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.6 KB | ↓ raw | |
| README.md | — | 257 B | ↓ raw | |
| build.sh | — | 95 B | view raw | |
| run.sh | — | 49 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 673 B | view raw | |
| verdict.json | — | 2.0 KB | view raw | |
| fix.diff | — | 547 B | view raw |
DF-2388 evidence pack
- finding: sys/dev/acpica/acpi_panasonic/acpi_panasonic.c (210-219)
- verdict: not_reproduced (certain) - see VERDICT.md
- source-only confirmation (no runtime PoC)
- reproduce: build.sh / run.sh
- fix.diff: present, git-apply-able
DF-2388 - Verification Verdict
Status: not_reproduced Impact: none (hardening) Confidence: certain
Mechanism
acpi_panasonic_detach unregisters the notify handler (AcpiRemoveNotifyHandler) and immediately frees the sysctl ctx / returns; in-flight ACPI notifies dispatched on the acpi_task helper can still be running acpi_panasonic_notify against the freed softc. DragonFly AcpiOsWaitEventsComplete is a no-op (acdragonfly.h:219) - proven drain-less by the verified sibling DF-2381 (acpi_fujitsu UAF panic, same class).
Verdict
NOT REPRODUCED (hardware/module-gated on this QEMU guest) - code-certain line-level confirmation in the read-only sys/ tree. Panasonic _HID ACPI hardware absent in the QEMU guest; class behavior already runtime-proven by DF-2381 (fatal trap on freed+sprayed softc).
Threat / reachability
Requires the named hardware/module; see VERDICT.md.
Privilege escalation assessment
n/a (device-gated)
Fix
Implement a real AcpiOsWaitEventsComplete (DF-2381 fix.diff: pending-count + drain in OsdSchedule.c) and call it in detach after removing the handler.
Kernel references
sys/dev/acpica/acpi_panasonic/acpi_panasonic.c:212sys/contrib/dev/acpica/source/include/platform/acdragonfly.h:219
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path (Info-tier hardening; see VERDICT.md)
Evidence (decisive lines)
VERDICT.md mechanism/verdict sections; fix.diff
PoC changes
none (source-only confirmation for this Info-tier item)
Verified recommended fix
Implement a real AcpiOsWaitEventsComplete (DF-2381 fix.diff: pending-count + drain in OsdSchedule.c) and call it in detach after removing the handler.
Verdict
NOT REPRODUCED (hardware/module-gated on this QEMU guest) - code-certain line-level confirmation in the read-only sys/ tree. Panasonic _HID ACPI hardware absent in the QEMU guest; class behavior already runtime-proven by DF-2381 (fatal trap on freed+sprayed softc).
No comments yet.