acpi_tz_attach: NULL-pointer panic when tz unit 0 fails acpi_tz_establish and a second thermal zone attaches (global sysctl tree dereferenced before creation)
Summary
acpi_tz_establish returns ENXIO when any _ALx object evaluates to a non-package; if that happens on unit 0, attach bails BEFORE the driver-global sysctl tree (created only for unit 0). Newbus still attaches the remaining zones; on unit 1+ the unconditional SYSCTL_ADD_NODE(..., SYSCTL_CHILDREN(acpi_tz_sysctl_tree), ...) evaluates SYSCTL_CHILDREN(NULL) = a raw (oid_ptr)->oid_arg1 dereference - NULL-page read panic during boot. Requires a DSDT with >=2 thermal zones where zone 0 has a malformed _ALx (boot-loader control = already root). All other hunt axes killed: integer params type-checked + sanity-clamped, polling range-validated, no detach method, sysctls root-gated, cooler loops NULL-safe via Foreach rejection. LIVE-verified the guest has 0 thermal zones (no hw.acpi.thermal OID, 0 ThermalZone objects in acpidump) - driver not instantiated. Tree-before-fail-paths fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4406 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 178 B | ↓ raw | |
| verdict.json | file | 1.2 KB | view raw |
DF-4406 — acpi_tz unit-0 failure NULL sysctl-tree panic
Firmware-gated boot-time DoS (malformed _ALx on zone 0 + >=2 zones). PoC skipped per contract (Low, firmware-gated).
Fix verification
not_testablecreate the global sysctl tree before anything that can fail attach (or NULL-guard per-zone node creation)
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
static 3-hop proof: establish ENXIO at :433-436 -> early return :237-240 before tree creation :253-258 -> zone-1 SYSCTL_CHILDREN(NULL) at :276-278 via sysctl.h:212-213
Verdict
source-verified; firmware/DSDT-gated (guest ACPI namespace has 0 ThermalZone objects - verified live)
No comments yet.