mpt_pci: DMA tag leak in mpt_dma_mem_alloc error paths
Summary
mpt_dma_mem_alloc(688-755) creates parent_dmat(712-721), reply_dmat(724-730), reply dmamem+dmap(733-738), bus_dmamap_load(744). On reply_dmat fail 728 return 1 with parent_dmat allocated. On dmamem_alloc fail 735 return 1 with parent+reply. On map_load mi.error 747-751 return 1 with parent+reply+dmamem live. Caller mpt_pci_attach:548 -> bad: calls mpt_dma_mem_free(760-776). mpt_dma_mem_free first action if (reply_dmat==NULL) return 763-767 so reply_dmat fail -> parent_dmat never destroyed. Resource leak per partial alloc fail. No memory-safety impact.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1745 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Destroy parent_dmat in mpt_dma_mem_free when reply_dmat is NULL. | 451 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1745 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: none Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/disk/mpt/mpt_pci.c:728,760-767.
Mechanism
mpt_dma_mem_alloc leaks parent_dmat on reply_dmat allocation failure; mpt_dma_mem_free returns early when reply_dmat==NULL without destroying parent_dmat.
Fix
Destroy parent_dmat in mpt_dma_mem_free when reply_dmat is NULL.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
mpt.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- m
- p
- t
- /
- m
- p
- t
- _
- p
- c
- i
- .
- c
- :
- 7
- 2
- 8
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- m
- p
- t
- /
- m
- p
- t
- _
- p
- c
- i
- .
- c
- :
- 7
- 6
- 0
- -
- 7
- 6
- 7
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/disk/mpt/mpt_pci.c:728,760-767. Fix compiled clean.
PoC changes
authored fix.diff: destroy parent_dmat in free when reply_dmat NULL
Verified recommended fix
Destroy parent_dmat in mpt_dma_mem_free early-return path. Matches finding proposal.
Verdict
REPRODUCED (source-only). mpt_dma_mem_alloc leaks parent_dmat on reply_dmat failure; free returns early without destroying parent.
No comments yet.