⬢ DragonFlyBSD Kernel Audit
DF-4269 / fix.diff
← back to finding ↓ download raw
fix.diff — DF-4269: free the allocation actually made (sc->wb_ldata).

wb_attach() allocates sc->wb_ldata (if_wb.c:779) but wb_detach() tests/frees
sc->wb_ldata_ptr, a distinct softc field that is never assigned anywhere in
the tree — the ~296KB contigmalloc block leaks on every detach (and on every
attach error path, which tail-calls wb_detach).

Applies on top of sys/dev/netif/wb/if_wb.c (read-only audit tree; never applied).

--- a/sys/dev/netif/wb/if_wb.c
+++ b/sys/dev/netif/wb/if_wb.c
@@ -853,8 +853,8 @@ wb_detach(device_t dev)
 	if (sc->wb_irq)
 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->wb_irq);
 	if (sc->wb_res)
 		bus_release_resource(dev, WB_RES, WB_RID, sc->wb_res);
-	if (sc->wb_ldata_ptr) {
-		contigfree(sc->wb_ldata_ptr, sizeof(struct wb_list_data) + 8,
+	if (sc->wb_ldata) {
+		contigfree(sc->wb_ldata, sizeof(struct wb_list_data) + 8,
 		    M_DEVBUF);
 	}