⬢ DragonFlyBSD Kernel Audit
DF-2305 / manifest.json
← back to finding ↓ download raw
{
  "finding_id": "DF-2305",
  "title": "bus_dma_tag_create failure at fwohci_pci.c:320-324 returns ENOMEM without cleanup (leaks BAR, IRQ, leaves handler registered)",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "scp -F dfbsd-qemu/config * dfbsd:/root/fwo/ && vm.sh run_root 'sh /root/fwo/fwpci_prep.sh && sh /root/fwo/build_kernel.sh' && vm.sh down && vm.sh up",
    "run": "vm.sh run_root 'sh /root/fwo/run.sh'",
    "expected": "test A: rc=12 with resource deltas MEM 1/0 IRQ 1/0 setup_intr 1 teardown 0 live_handlers=1 (leak); test C forced detach releases everything; test D sibling irq-fail path balanced MEM 1/1; test B re-attach refused (rman conflict, Could not map memory, ENXIO) and sc->bsr orphaned"
  },
  "kernel_refs": [
    "sys/bus/firewire/fwohci_pci.c:320-324",
    "sys/bus/firewire/fwohci_pci.c:267-272",
    "sys/bus/firewire/fwohci_pci.c:278-284",
    "sys/bus/firewire/fwohci_pci.c:287-298",
    "sys/bus/firewire/fwohci_pci.c:326-332",
    "sys/platform/pc64/x86_64/busdma_machdep.c:820-860",
    "sys/kern/subr_bus.c:2121"
  ],
  "artifacts": [
    "fwpci_harness.c", "fwpci_harness.h", "fwohci_harness.c", "fwohci_harness.h",
    "fwpcictl.c", "fwpci_prep.sh", "build_kernel.sh", "build_fix.sh",
    "run.sh", "run.log", "dmesg.txt", "run_fixed.log", "fix.diff",
    "env.txt", "build.log", "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}