DF-5093
wbsio_detach never detaches its lm child (no bus_generic_detach): driver unload leaves a dangling attached child with a live 5s sensor task, leaked rman ports, and a NULL-ops parent β any later bus op on the child is a guaranteed NULL-deref panic
Summary
The detach violates the newbus bus-driver contract - devclass_delete_driver skips grandchildren, so the lm child stays DS_ATTACHED with a live sensor task while the parent's softc is freed and kobj ops NULLed; the next BUS_* dispatch through the parent (e.g. kldunload lm) KOBJOPLOOKUPs NULL -> guaranteed panic (UAF in module builds). Root-gated module-build + Winbond-hardware gated (probe reads 0xff on QEMU - untestable). bus_generic_detach one-liner fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5093 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5093
Confirmed kernel references
Detail
Evidence (decisive lines)
static newbus/kobj trace in finding markdown (subr_bus.c:888-897,1943-1946; subr_kobj.c:264-270; kobj.h:237-240)
Verified recommended fix
bus_generic_detach(dev) in wbsio_detach
Verdict
untested (hardware-gated: no Winbond Super I/O on QEMU guest; probe reads 0xff/ENXIO)
No comments yet.