evdev: client memory and lock leak in evdev_open error paths
Summary
evdev_open at cdev.c:118-129 kmallocs client (M_WAITOK|M_ZERO) and inits ec_buffer_mtx. Error paths only set ret return 157 NO cleanup. (a) si_drv1==NULL at 133 -> ret=ENODEV -> revoke 139 -> UNLOCK 144 -> if(ret==0) false at 146 -> return ENODEV; client+lock leaked. (b) evdev_register_client fails at 136; same. (c) devfs_set_cdevpriv fails at 150 (fp==NULL ENOENT or f_data1 set EBUSY per devfs_core.c:2966-2985) AFTER evdev_register_client at evdev.c:993 LIST_INSERT_HEAD -> client on ev_clients but no dtor; close never calls evdev_dtor -> stays on list leaks forever; evdev_unregister will LIST_REMOVE but still not kfree. Root+RESTRICTEDROOT + race opens vs detach. M_EVDEV unbounded growth -> kmem exhaustion DoS.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1714 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Free client+lockuninit on the si_drv1==NULL error path before returning. | 455 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1714 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: dos Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/misc/evdev/cdev.c:131-150.
Mechanism
evdev_open kmallocs client and inits ec_buffer_mtx but error paths (si_drv1==NULL) set ret and fall through without freeing the client, leaking M_EVDEV memory under repeated open/detach races.
Fix
Free client+lockuninit on the si_drv1==NULL error path before returning.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
evdev.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- m
- i
- s
- c
- /
- e
- v
- d
- e
- v
- /
- c
- d
- e
- v
- .
- c
- :
- 1
- 3
- 1
- -
- 1
- 5
- 0
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/misc/evdev/cdev.c:131-150. Fix compiled clean.
PoC changes
authored fix.diff: free client on si_drv1 NULL path
Verified recommended fix
Free client+lockuninit on si_drv1==NULL error path. Matches finding proposal.
Verdict
REPRODUCED (source-only). evdev_open leaks client+lock on si_drv1==NULL error path; M_EVDEV unbounded growth under open/detach races.
No comments yet.