⬢ DragonFlyBSD Kernel Audit
DF-4474 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-4474",
  "title": "dm ioctl error paths leak proplib objects: unreleased array iterator (retaining the whole inbound cmd_data tree) in dm_table_load_ioctl; unreleased cmd_array in deps/status ENOENT paths",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -o dm_errleak dm_errleak.c -lprop",
    "run": "./dm_errleak 100 20000 ; ./dm_errleak 60 0 4000",
    "expected": "M_TEMP InUse grows by exactly +1 object per failed reload, permanent, never drops; with 4000-entry trees ~3.5MB kernel memory stays consumed per failed reload (page accounting)"
  },
  "kernel_refs": [
    "sys/dev/disk/dm/dm_ioctl.c:707-708",
    "sys/dev/disk/dm/dm_ioctl.c:711-713",
    "sys/dev/disk/dm/dm_ioctl.c:739-741",
    "sys/dev/disk/dm/dm_ioctl.c:783-789",
    "sys/dev/disk/dm/dm_ioctl.c:601-606",
    "sys/dev/disk/dm/dm_ioctl.c:895-899",
    "sys/libprop/prop_array.c:513-529"
  ],
  "artifacts": [
    "dm_errleak.c", "build.sh", "run.sh", "run.log",
    "fix.diff", "env.txt", "VERDICT.md", "README.md", "manifest.json", "verdict.json"
  ]
}