Missing bounds check in devclass_alloc_unit permits heap underflow write / NULL-deref panic for negative non-wildcard unit
Summary
devclass_alloc_unit validates wired unit only with unit>=0 nested inside conditional skipped for negative values. Negative non-wildcard unit (<-1) bypasses table-grow branch and returned as-is caller then executes dc->devices[dev->unit]=dev writing at negative array index heap buffer underflow or for fresh devclass dc->devices==NULL write near NULL panics kernel. No unprivileged runtime path injects unit requires buggy/malicious loadable driver kldload root or crafted boot hints. Memory-safety defect certain but concrete unprivileged trigger not demonstrated. [VERIFIED pass2: reproduced - real device_add_child with unit -5 Fatal trap 12 supervisor WRITE at 0xffffffffffffffd8 devclass_add_device dc devices index -5; root-kld gated as filed; NULL-return fix A/B]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2544 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| rig.c | — | 1.7 KB | view raw | |
| Makefile | — | 129 B | ↓ download | |
| build.sh | — | 93 B | view raw | |
| run.sh | — | 90 B | view raw | |
| panic.txt | — | 13.6 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
panic.txt: Fatal trap 12 WRITE at 0xffffffffffffffd8 (-40) in devclass_add_device
PoC changes
KLD registering a real driver + real device_add_child, sysctl-triggered
Verified recommended fix
reject unit < -1 in devclass_alloc_unit (in the combined fix kernel)
Verdict
devclass_alloc_unit (subr_bus.c:1067+) only inspects wired units for unit>=0; a negative non-wildcard unit (<-1) is returned as-is, and devclass_add_device (:1141) then executes dc->devices[dev->unit]=dev. Driven through the REAL device_add_child(nexus, dfp44, -5): deterministic kernel panic Fatal trap 12, fault virtual address 0xffffffffffffffd8, supervisor WRITE data stopped at devclass_add_device+0xf6 -- the write at dc->devices[-5] with devices==NULL. On a devclass with an allocated table the same code writes 40 bytes before the heap array. No unprivileged path injects unit (requires buggy/malicious driver registration, i.e. root/kld); the memory-safety defect itself is proven live.
No comments yet.