NULL-pointer dereference in envy24_pci_attach error path when resource allocation fails before cfg initialization
Summary
If envy24_alloc_resource fails (I/O port or IRQ exhaustion), attach jumps to 'bad' with sc->cfg still NULL (set only inside envy24_init) and the cleanup dereferences sc->cfg->codec -> panic during device attach. Mirror of DF-1331 (envy24ht.c) on a distinct trigger path; distinct from DF-1322 (crash inside envy24_init). Privileged/physical context only. PoC skipped per contract; NULL-guard fix (same shape as the envy24ht sibling).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3997 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 396 B | ↓ raw | |
| verdict.json | file | 1.1 KB | view raw |
DF-3997 — envy24.c attach-error NULL deref (sc->cfg->codec at :2623)
envy24_alloc_resource failure (envy24.c:2570) jumps to 'bad' before envy24_init assigns sc->cfg (2409-2425); cleanup derefs sc->cfg->codec -> NULL deref panic at attach. Low: privileged/physical trigger only. Fix: NULL-guard the codec-destroy loop (same shape as the envy24ht.c fix for DF-1331). PoC skipped per contract.
Fix verification
not_testableguard the codec-destroy loop with if (sc->cfg && sc->cfg->codec && sc->cfg->codec->destroy != NULL) — same guard as the envy24ht.c sibling fix for DF-1331
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
static path: envy24.c:2570 goto bad before sc->cfg assigned at 2409-2425; cleanup derefs sc->cfg->codec at 2623
Verdict
source-verified; PoC skipped per contract (Low, no unprivileged trigger)
No comments yet.