β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5209

pci_iomap() treats pci_resource_start()'s -1 failure sentinel as a valid base and drives __ioremap_common() into BUG_ON panic for any absent/unallocatable BAR

Summary

The shim guards only base==0 but the getter signals failure with -1 - a missing/unallocatable BAR feeds ~0 into ioremap where BUG_ON(phys_addr & PAGE_MASK) is guaranteed true. Attach-time panic on quirky/malicious PCIe hardware; every in-tree caller is written to the NULL contract. Validate-both-sentinels fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5209 Β· 1 files
FileTypeDescriptionSize
verdict.json file 903 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5209

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (hardware-/root-gated; Low/Info per contract)