DragonFlyBSD Kernel Audit
DF-0207 / leak_sample.txt
← back to finding ↓ download raw
DF-0207 clist_alloc_cblocks memory leak - vmstat -m (M_TTYS) before/after harness load
Harness: 3000 iterations, each calling clist_alloc_cblocks(cl,4096) then clist_alloc_cblocks(cl,1024)
         -> each call with a new ccmax orphans the previous kmalloc'd c_data buffer.

BEFORE kldload:   ttys   Count=37     MemUse=143K    Requests=76
AFTER  kldload:   ttys   Count=5.90K  MemUse=29.4M   Requests=5.93K
DELTA:            ~5863 live c_data buffers orphaned, ~29MB of M_TTYS permanently leaked.
                  (clist_free_cblocks at unload only frees the LAST live buffer; the
                   ~3000 prior buffers are unreachable => permanent kmem leak.)

This is direct proof the bug at sys/kern/tty_subr.c:80 (cl->c_data = data without kfree
of the old pointer) leaks on every resize. Impact ceiling: unbounded M_TTYS kmem exhaustion
(DoS) on any code path that changes a clist's ccmax (sio serial baud changes, netgraph/sl
drivers, or any tty whose t_*speedwat != 0).