⬢ DragonFlyBSD Kernel Audit
DF-5014 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5014",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardware-gated: no LSI SAS2008/MPT2 controller on the audit guest, so mps_attach cannot run; both defect paths are unconditional control flow in the source. (1) mps_attach() returns error without any unwind at mps.c:1043-1044 and mps.c:1072-1073, leaking the sc->facts allocation made at mps.c:1041-1042 (mps_pci_free does not free it). (2) Whenever mps_free() early-returns (mps.c:1323-1325, 1331-1334 - realistic exactly when the IOC is wedged, e.g. after the transition-operational failure at mps.c:1128-1133), all queue DMA tags and memory remain allocated while mps_pci_attachs unwind calls mps_pci_free() -> bus_dma_tag_destroy(mps_parent_dmat) (mps_pci.c:289-291); bus_dma_tag_destroy (busdma_machdep.c:334-346) has no parent-child refcount, so the parent tag is silently freed over live child tags (dangling dmat->parent in six live kernel objects) and all queue DMA memory leaks. Boot/hotplug-time resource-leak + latent dangling-pointer class; no attacker-controlled input.",
  "exploit_chain": "",
  "evidence": "VERDICT.md mechanism section with the four cited sites; the leak paths need no concurrency - only a failing IOC at attach",
  "kernel_refs": [
    "sys/dev/raid/mps/mps_pci.c:234",
    "sys/dev/raid/mps/mps_pci.c:289",
    "sys/dev/raid/mps/mps.c:1041",
    "sys/dev/raid/mps/mps.c:1043",
    "sys/dev/raid/mps/mps.c:1072",
    "sys/dev/raid/mps/mps.c:1128",
    "sys/dev/raid/mps/mps.c:1323",
    "sys/dev/raid/mps/mps.c:1331",
    "sys/platform/pc64/x86_64/busdma_machdep.c:334"
  ],
  "poc_changes": "authored from source analysis; no runnable PoC possible (no mps hardware on guest)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding beyond the known DF-2044 (never-allocated IRQ release in mps_pci_free - not re-reported; the sibling bus_setup_intr-failure variant with a valid irq resource and NULL cookie shares DF-2044s root cause and fix). config_intrhook_establish cannot fail for a fresh bzerod softc (only double-establish, subr_autoconf.c:137-155), so the mps.c:1195 EINVAL fall-through was analyzed and killed. pci_release_msi cannot fire spuriously (irq_type[0]==0==INTX on bzero). Suspend/resume EINVAL fails safe.",
  "recommended_fix": "kfree sc->facts (and NULL it) on the two early-error returns in mps_attach() - see fix.diff; ride along with DF-2044s NULL guards in mps_pci_free.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff (git apply --check clean) frees sc->facts at both early-error sites. Single-fix kernel build not meaningful: entry is hardware-gated (no SAS2008 on guest); fix validated by inspection.",
  "fix_evidence": "fix.diff; VERDICT.md Fix section"
}