β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5166

disable_irq/enable_irq resolve the victim entry by irq number only, ignoring dev_id β€” teardown/re-setup of the wrong device's handler whenever two registrations share or numerically collide on an irq

Summary

free_irq matches the (irq,dev_id) pair but disable/enable match irq only and take the SLIST head - on shared-INTx multi-GPU or duplicate registrations driver A silently tears down driver B's handler while its own stays armed. No in-tree callers on this shim today. Match-the-pair + lock fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5166 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.0 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5166

Confirmed kernel references

Detail

Evidence (decisive lines)

source trace in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (no DRM substrate on QEMU guest: request_irq cannot execute there; proven by line-level source trace)