ath_descdma_setup() returns error==0 (success) after tearing everything down when the ath_buf array kmalloc fails — and the unvalidated RWTUN hw.ath.*buf sysctls feeding it make the failure deterministic (and can truncate bsize into a small kmalloc walked OOB by the setup loop)
Summary
The bf==NULL path never sets error, fail3 tears down and returns the stale 0 - callers proceed on a zeroed descdma (NULL descriptors, empty list): first TX/RX panics or hangs. The unvalidated RWTUN counts make it deterministic (huge -> NOWAIT fail; truncating values -> small kmalloc + setup loop walks OOB). Hw-gated; control-flow certain. Set-error + validate fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4908 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.5 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
root: sysctl hw.ath.txbuf=
Evidence (decisive lines)
findings/poc/DF-4908/ (this verdict; control-flow certainty - error provably 0 at fail3)
Verdict
Hardware-gated (no ath NIC on guest; function needs live bus_dma+HAL): ath_descdma_setup's bf-array kmalloc failure path leaves error==0 (from the prior successful alloc_desc), tears everything down at fail3 (unload/free/destroy/memset dd) and returns SUCCESS - every caller proceeds on a zeroed descdma (dd_desc NULL, never-initialized buffer list): first TX/RX = NULL deref/unbounded no-buffer -> panic or hang. Deterministically reachable because hw.ath.rxbuf/txbuf/txbuf_mgmt are unvalidated RWTUN sysctls feeding the int math: huge values force the M_NOWAIT failure, and values where sizeof(ath_buf)*nbuf truncates to a small positive int make the kmalloc SUCCEED small while the setup loop TAILQ_INSERTs far past it (heap OOB writes). Set-error + validate-the-counts fix.
No comments yet.