aac_close_aif orphans fibctx list when removing head, leaking every subsequent context permanently
Summary
aac_close_aif() at aac.c:3497-3498: when ctx==sc->fibctx (head removal), sets sc->fibctx=NULL instead of sc->fibctx=ctx->next. Drops all references to tail nodes. Orphaned struct aac_fib_context objects (~32B each) permanently leaked. Operator group: open, open, close-first per iteration leaks one context forever. No detach cleanup. Fix: sc->fibctx=ctx->next, set prev=NULL if non-NULL.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1233 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 923 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 687 B | view raw |
DF-1233 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
aac_close_aif orphans fibctx list when removing head, leaking every subsequent context permanently
Source Location
sys/dev/raid/aac/aac.c:3488-3510
Verdict
Source-confirmed: aac_close_aif orphans fibctx list when removing head, leaking every su. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
aac_close_aif() at aac.c:3497-3498: when ctx==sc->fibctx (head removal), sets sc->fibctx=NULL instead of sc->fibctx=ctx->next. Drops all references to tail nodes. Orphaned struct aac_fib_context objects (~32B each) permanently leaked. Operator group: open, open, close-first per iteration leaks one context forever. No detach cleanup. Fix: sc->fibctx=ctx->next, set prev=NULL if non-NULL.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: aac_close_aif sets sc->fibctx=NULL when removing head, orphaning all subsequent contexts (permanent leak). Fixed to sc->fibctx=ctx->next.
Verified recommended fix
Source-confirmed: aac_close_aif sets sc->fibctx=NULL when removing head, orphaning all subsequent contexts (permanent leak). Fixed to sc->fibctx=ctx->next.
Verdict
Source-confirmed: aac_close_aif sets sc->fibctx=NULL when removing head, orphaning all subsequent contexts (permanent leak). Fixed to sc->fibctx=ctx->next.
No comments yet.