isc_sm: memory leak - proc_out default-error branch leaks non-CCB pduq on any non-EAGAIN/EPIPE send error
Summary
proc_out isc_sm.c:540-558 default case: if(pq->ccb){...pdu_free(sp->isc,pq);} else xdebug(we lost it!). else branch has NO pdu_free. Contrast EAGAIN/EPIPE at 546 requeues via i_rqueue_pdu; ccb!=NULL default at 554 does pdu_free. ccb==NULL default leaks permanently. Root on /dev/iscsiN triggering sosend ENOBUFS/EHOSTUNREACH on login/text/logout/nop-out (ccb==NULL) -> exhaust MAX_PDUS=65536 -> pdu_alloc NULL -> session permanent stuck. Fix: pdu_free unconditionally in default.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1760 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add pdu_free in the default-case else branch. | 388 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1760 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: dos Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/disk/iscsi/initiator/isc_sm.c:540-558.
Mechanism
proc_out default case: when ccb==NULL the else branch does xdebug but no pdu_free; leaks a pdu permanently. Under ENOBUFS on non-CCB commands exhausts MAX_PDUS=65536.
Fix
Add pdu_free in the default-case else branch.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
iscsi module built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- i
- s
- c
- s
- i
- /
- i
- n
- i
- t
- i
- a
- t
- o
- r
- /
- i
- s
- c
- _
- s
- m
- .
- c
- :
- 5
- 4
- 0
- -
- 5
- 5
- 8
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/disk/iscsi/initiator/isc_sm.c:540-558. Fix compiled clean.
PoC changes
authored fix.diff: add pdu_free in default else branch
Verified recommended fix
Add pdu_free in default-case else branch. Matches finding proposal.
Verdict
REPRODUCED (source-only). proc_out default else branch (ccb==NULL) has no pdu_free; leaks pdus permanently, exhausts MAX_PDUS=65536.
No comments yet.