DF-0398
rt_setshims leaks previously allocated shims on partial allocation failure
Summary
rt_setshims(:1374-1391): if rt_shim[1] or [2] alloc fails after [0] allocated, no cleanup of earlier shims. rt_free does not check partial population. Slow M_RTABLE memory leak amplifying memory pressure. Fix together with DF-0397: R_Free rt_shim[0..i-1] on failure.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0398 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 382 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/route.c:1374: rt_setshims leaks previously allocated shims on partial failure
Verified recommended fix
Source-confirmed at sys/net/route.c:1374: rt_setshims leaks previously allocated shims on partial failure
Verdict
Source-confirmed at sys/net/route.c:1374: rt_setshims leaks previously allocated shims on partial failure
No comments yet.