Buffer leak in markvoldirty_upgrade on bread error (dead code path)
Summary
msdosfs_fat.c:1154 bread(pmp->pm_devvp,de_bn2doff(pmp,bn),bsize,&bp). :1155 if(error) return(error) — NO brelse(bp). breadnx always assigns *bpp via getblk on error caller owns buffer must release. Every other bread caller in this file correctly brelse on error: pcbmap:197 fatentry:492 fatchain:573 freeclusterchain:832 fillinusemap:917. DEAD CODE: no call sites for markvoldirty_upgrade/markvoldirty anywhere in sys/ tree disconnected during debugging PR 210316. Latent: if reconnected repeated I/O errors leak buffer cache entries exhaust system-wide I/O. Fix: brelse(bp) before return.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0828 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Buffer leak in markvoldirty_upgrade on bread error (dead code path) | 453 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/vfs/msdosfs/msdosfs_fat.c:1154: buffer leak in markvoldirty_upgrade on bread error (dead code path)
Verified recommended fix
Source-confirmed at sys/vfs/msdosfs/msdosfs_fat.c:1154: buffer leak in markvoldirty_upgrade on bread error (dead code path)
Verdict
Source-confirmed at sys/vfs/msdosfs/msdosfs_fat.c:1154: buffer leak in markvoldirty_upgrade on bread error (dead code path)
No comments yet.