β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5093

wbsio_detach never detaches its lm child (no bus_generic_detach): driver unload leaves a dangling attached child with a live 5s sensor task, leaked rman ports, and a NULL-ops parent β€” any later bus op on the child is a guaranteed NULL-deref panic

Summary

The detach violates the newbus bus-driver contract - devclass_delete_driver skips grandchildren, so the lm child stays DS_ATTACHED with a live sensor task while the parent's softc is freed and kobj ops NULLed; the next BUS_* dispatch through the parent (e.g. kldunload lm) KOBJOPLOOKUPs NULL -> guaranteed panic (UAF in module builds). Root-gated module-build + Winbond-hardware gated (probe reads 0xff on QEMU - untestable). bus_generic_detach one-liner fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5093 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.0 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5093

Confirmed kernel references

Detail

Evidence (decisive lines)

static newbus/kobj trace in finding markdown (subr_bus.c:888-897,1943-1946; subr_kobj.c:264-270; kobj.h:237-240)

Verified recommended fix

bus_generic_detach(dev) in wbsio_detach

Verdict

untested (hardware-gated: no Winbond Super I/O on QEMU guest; probe reads 0xff/ENXIO)