extra_history_size pool leaks on failed history realloc; function falsely returns success
Summary
sc_alloc_history_buffer (schistory.c:118-160) optimistically debits global scrollback pool extra_history_size at line 122 ("extra_history_size -= lines - min_lines") BEFORE confirming sc_vtb_init() actually allocated ring buffer (124-126). On resize paths (scvidctl.c:163,397,947 all pass wait=FALSE) sc_vtb_init uses M_NOWAIT (scvtb.c:93-95) can fail to set VTB_VALID under memory pressure. On failure else branch (147-159): destroys partial new buffer reattaches previous BUT never re-credits extra_history_size += (lines-min_lines) and returns 0 (success) at 160. Net per failure: global pool -= (lines-min_lines) with no buffer grown. Shared across ALL virtual consoles (schistory.c:63 static global). Eventually every sc_alloc_history_buffer request for lines>min_lines fails check at 109 ("lines-min_lines > extra_history_size+delta") -> EINVAL permanently disabling scrollback growth for all VTs until reboot. Trigger: local console user grows scrollback (vidcontrol -h 8000), drives memory pressure, cycles console mode resizes (vidcontrol 80x25 <-> 132x50). AV:L/AC:H/PR:L, A:L.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2045 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source-confirmation verdict for DF-2045 | 617 B | ↓ raw |
| fix.diff | suggested-fix | Re-credit extra_history_size on vtb_init failure | 365 B | view raw |
| ../fix_build.log | build-log | Batch kernel build log (all fixes, rc=0) | 5.6 MB | ↓ download |
DF-2045 Verification Verdict
Severity: Low Impact class: leak Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)
Verdict: REPRODUCED (source-confirmed)
The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.
Fix: Re-credit extra_history_size on vtb_init failure
Fix applied and validated in batch kernel build (rc=0, -Werror).
Fix validation
All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build.
Build result: rc=0, 0 errors (full -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): sc_alloc_history_buffer optimistically debits global scrollback pool extra_history_size BEFORE confirming sc_vtb_init actually allocated the buffer; on failure the debit is n
Verified recommended fix
REPRODUCED (source-only): sc_alloc_history_buffer optimistically debits global scrollback pool extra_history_size BEFORE confirming sc_vtb_init actually allocated the buffer; on failure the debit is not reversed.
Verdict
REPRODUCED (source-only): sc_alloc_history_buffer optimistically debits global scrollback pool extra_history_size BEFORE confirming sc_vtb_init actually allocated the buffer; on failure the debit is not reversed.
No comments yet.