Summary

wbsio_attach allocates sc->sc_iores (the 2-byte I/O port mapping for the SIO config space) at wbsio.c:218 before adding the lm child. Three error paths after that allocation — BUS_ADD_CHILD returning NULL (:257), bus_set_resource failing (:261), and device_probe_and_attach failing (:265) — return non-zero from attach without releasing sc->sc_iores. Newbus confirmed at subr_bus.c:2108-2124 that when a driver's attach method returns non-zero, dev->state is set to DS_NOTPRESENT and device_set_driver(dev, NULL) is called; device_detach (subr_bus.c:2136) then short-circuits on dev->state != DS_ATTACHED and never invokes the driver's device_detach method. Therefore wbsio_detach (wbsio.c:269) is never called on these paths and the SYS_RES_IOPORT resource leaks.

Root cause

• wbsio.c:218-220 allocates sc->sc_iores via bus_alloc_resource(..., RF_ACTIVE).
• wbsio.c:256 — lm child created via BUS_ADD_CHILD; if NULL, return ENXIO at :259 without releasing sc->sc_iores.
• wbsio.c:261 — bus_set_resource may fail and :263 returns ENXIO, again leaking sc->sc_iores (and the just-added child is orphaned in the tree).
• wbsio.c:265 — device_probe_and_attach(child) may return non-zero and that value is returned directly, leaking sc->sc_iores.

The iobase == 0 path at :251-254 is correctly not a leak because it returns 0, leaving the device attached so detach later releases the resource. Confirmed newbus behavior: device_doattach (subr_bus.c:2108) only sets DS_ATTACHED (:2110) when error == 0; on error it sets DS_NOTPRESENT (:2122) and device_detach (:2136) bails before calling DEVICE_DETACH.

Threat model & preconditions

• Attacker position: privileged local user (root — kldload requires it).
• Privileges gained or impact: none. The driver exposes no unprivileged entry point.
• Required config or capabilities: a Winbond/Nuvoton SIO chip present on the LPC bus whose HM base iobase is non-zero but whose lm child fails to probe/attach.
• Reachability: attach runs once at boot or kldload time. Looping kldload/kldunload wbsio on such hardware leaks one SYS_RES_IOPORT (2 bytes of ISA port space and its bus_space mapping) per iteration. Root can trivially DoS the system without this primitive, so this is a code-quality / hardening issue only.

Proof of concept

Not a security exploit — a reproducible resource-leak demonstration only, requiring root and specific hardware. On a host with a Winbond/Nuvoton SIO present at 0x2e (e.g. W83627DHG):

1. Build the module: cd /sys/dev/powermng/wbsio && make && cp wbsio.ko /root/.
2. Force the leak by ensuring the lm child's probe returns failure — easiest on real hardware is to set the HM iobase to a valid-but-unreachable port via the SIO config registers before loading, so lm_isa_probe's bus_space_read at lm78_isa.c:115 returns 0xff and chip-id lookup fails.
3. Loop as root: for i in $(jot 1000); do kldload /root/wbsio.ko; kldunload wbsio.ko; done.
4. Observe via vmstat -m / pstat -t / devinfo -r that SYS_RES_IOPORT allocations grow without bound, or that repeated loads eventually fail with resource-exhaustion.

Impact

Code-quality / hardening only. No memory corruption, no info leak, no privilege escalation. Requires root to trigger.

Recommended fix

Release sc->sc_iores (and NULL it) on every error path after the allocation at :218. Use a cleanup label so all three failing paths share one release.

--- a/sys/dev/powermng/wbsio/wbsio.c
+++ b/sys/dev/powermng/wbsio/wbsio.c
@@ -253,22 +253,30 @@ wbsio_attach(device_t dev)

    if (iobase == 0) {
        device_printf(dev, "no hardware monitor configured\n");
+       /* sc_iores intentionally retained; detach will release it */
        return 0;
    }

    child = BUS_ADD_CHILD(dev, dev, 0, "lm", -1);
    if (child == NULL) {
        device_printf(dev, "cannot add child\n");
-       return ENXIO;
+       goto fail;
    }
    if (bus_set_resource(child, SYS_RES_IOPORT, 0, iobase, 8, -1)) {
        device_printf(dev, "cannot set resource\n");
-       return ENXIO;
+       goto fail;
    }
-   return device_probe_and_attach(child);
+   if (device_probe_and_attach(child) != 0) {
+       device_printf(dev, "cannot attach lm child\n");
+       goto fail;
+   }
+   return 0;
+
+fail:
+   bus_release_resource(dev, SYS_RES_IOPORT, sc->sc_iorid, sc->sc_iores);
+   sc->sc_iores = NULL;
+   return ENXIO;
 }

References

• sys/kern/subr_bus.c:2108-2124,2136 — newbus attach/detach state machine that skips DEVICE_DETACH on attach failure.

Timeline

• 2026-07-25 Discovered during automated audit.
• 2026-07-25 Reported to DragonFlyBSD security contact.