⬢ DragonFlyBSD Kernel Audit
DF-4969 / adw_static_check.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-4969 static reproduction: print the exact cited error-unwind lines from the
# guest's kernel source, demonstrating the leaked resources on each path.
# (Runtime reproduction requires AdvanSys PCI hardware - none present on this guest.)
set -e
SRC=${1:-/usr/src/sys/dev/disk/advansys}

echo "== adw_pci.c: resource acquisition sites =="
echo "-- [1] regs = bus_alloc_resource (adw_pci.c:211-225)"
sed -n '207,225p' $SRC/adw_pci.c
echo
echo "-- [2] adw = adw_alloc(dev, regs, ...) keeps regs in the softc (adw_pci.c:227-229)"
sed -n '227,229p' $SRC/adw_pci.c
echo
echo "-- [3] setup() failure: returns WITHOUT adw_free and WITHOUT releasing regs (adw_pci.c:242-245)"
sed -n '240,246p' $SRC/adw_pci.c
echo
echo "-- [4] irq = bus_alloc_resource (adw_pci.c:291-298)"
sed -n '291,298p' $SRC/adw_pci.c
echo
echo "-- [5] every post-adw_alloc failure calls only adw_free() (adw_pci.c:235-238, 265-270, 274-278, 295-298, 300-303)"
sed -n '300,303p' $SRC/adw_pci.c
echo
echo "== adwcam.c: adw_free() NEVER releases regs/irq and never tears down the intr (adwcam.c:844-886) =="
sed -n '844,886p' $SRC/adwcam.c
echo
echo "-- [6] adw_attach hooks the interrupt and starts the RISC before any later step (adwcam.c:1156-1161)"
sed -n '1153,1162p' $SRC/adwcam.c
echo
echo "CONCLUSION: on every attach failure path the PCI register resource (and the IRQ"
echo "resource once allocated) stays allocated forever; on the setup() failure path the"
echo "kmalloc'd softc leaks too. No bus_teardown_intr exists anywhere in the driver."