DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2441

dmstrategy and dmdump dereference dev->si_drv1 without NULL check unlike dmsize and disk_ioctl_switch

Summary

dmstrategy and dmdump unconditionally dereference dev->si_drv1 (dmv) without any NULL guard whereas dmsize and disk_ioctl_switch both defend against it. If si_drv1 ever NULL when strategy/dump entered immediate dereference at :401 (dm_table_size(&dmv->table_head)) or :488 faults kernel. Not reachable today: disk layer diskopen refuses open until d_slice set (populated by dmsetdiskinfo post-resume long after si_drv1 assigned). Inconsistency between 4 sibling entry points in same file is defense-in-depth gap would become live panic if future change relaxes d_slice gating or teardown path NULLs si_drv1 while bio in flight.

Discussion (0)

No comments yet.