DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2524

trm_Disconnect dereferences pDCB->pActiveSRB without NULL check kernel panic on spurious disconnect (acknowledged in source)

Summary

trm_Disconnect fetches pSRB=pDCB->pActiveSRB and immediately dereferences pSRB->pccb. Author left literal comment bug pSRB=0 at :2355 acknowledging unguarded dereference. DISCONNECT or selection-timeout interrupt arriving without prior successful selection (pActiveSRB would have been set by trm_StartSCSI) NULL-dereferences panics kernel. pActiveSRB only assigned in trm_StartSCSI:1287 and trm_Reselect cleared to NULL in trm_Disconnect:2402 after SRB_COMPLETED. Malicious/misbehaving SCSI device can trigger spurious DISCONNECT/SELTIMEOUT.

Discussion (0)

No comments yet.