Memory leak in backlight_destroy: softc is never freed
Summary
backlight_register() kmalloc-s softc (line 111) but backlight_destroy() (130-140) never kfree-s it. Reads sc = dev->si_drv1 frees unit number calls destroy_dev(dev) but never kfree(sc M_BACKLIGHT). Softc leaked si_drv1 left dangling. rg kfree sys/dev/misc/backlight/ returns nothing. Requires root to trigger detach. Repeated attach/detach leaks sizeof(struct backlight_softc) per cycle slow memory-exhaustion vector privileged-only no unprivileged impact.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2184 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | file | 696 B | ↓ raw | |
| build.sh | file | 161 B | view raw | |
| fix.diff | file | 171 B | view raw | |
| run.sh | file | 80 B | view raw |
DF-2184 - Verification Verdict
Status: reproduced (source-confirmed) Impact: none Confidence: certain
Verdict
Source-confirmed: backlight_register kmalloc sc (:111) but backlight_destroy (:130-140) never kfree; memory leak; backlight-gated
Fix Status
Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)
Source File
sys/dev/misc/backlight/backlight.c
Fix Validation
All 87 fix.diffs compiled together in a single batch kernel build
(make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors).
The combined patch is at findings/poc/batch_build/all_fixes.patch.
Fix verification
fixedbatch build rc=0
batch build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
backlight_destroy never kfree sc; backlight-gated
Verified recommended fix
backlight_destroy never kfree sc; backlight-gated
Verdict
backlight_destroy never kfree sc; backlight-gated
No comments yet.