Allocation-failure path in mpr_mapping_allocate_memory kfrees NULL (panic on DragonFly) / stale pointers; mpr_mapping_initialize return ignored by both callers
Summary
The free_resources path kfrees ALL six table pointers after any partial allocation failure. On the first (attach) call the un-allocated pointers are NULL and DragonFly's kfree(NULL) PANICS - this code was ported from FreeBSD where free(NULL) is a no-op. The free helper does not NULL the pointers, so a reinit retry double-frees stale pointers. Additionally both callers ignore the error return, so after a failure the driver continues with NULL/dangling mapping_table and every event handler walks it. Any M_NOWAIT failure among the firmware-sized arrays turns into a panic instead of a graceful attach failure. Guard+NULL+propagate fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3918 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 449 B | view raw |
Confirmed kernel references
β
Detail
Evidence (decisive lines)
β
Verdict
Low - PoC skipped per contract (hardware-gated logic/error-path classes). Source-certain; fixes authored; DF-3916/3917 also reported against FreeBSD head.
No comments yet.