DF-5524
Unchecked device_add_child in iicsmb_attach: a failed smbus allocation leaves sc->smbus NULL and the next slave-mode interrupt dereferences it via smbus_intr(NULL,...)
Summary
The allocation is unchecked (contrast iicbb which returns ENXIO): with sc->smbus NULL, iicsmb_intr hands NULL into smbus_intr on both the INTR_STOP and INTR_ERROR paths -> device_get_softc(NULL) -> Fatal trap 12. ENOMEM-at-attach + a controller interrupt. Check-and-guard fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5524 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 899 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5524
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (Info hardening; ENOMEM-window / producer-regression gated)
No comments yet.