DF-2856
Whole-chunk reuse path inherits previous owner's r_virtual/r_bustag/r_bushandle/r_rid and stale RF_SHAREABLE bit — cross-driver data hygiene leak via rman_get_* accessors
| Field | Value |
|---|---|
| ID | DF-2856 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N |
| CWE | CWE-908 / CWE-459 |
| File | sys/kern/subr_rman.c |
| Lines | 257-263, 347, 594 |
| Area | kern |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
int_rman_release_resource only clears RF_ALLOCATED, and the whole-chunk takeover path ORs flags and sets r_dev without resetting r_virtual, r_bustag, r_bushandle or r_rid — a re-allocated chunk carries the PREVIOUS owner's mapping pointer and bus handle, readable by the new owner via rman_get_virtual()/rman_get_bushandle() if the driver reads before writing. The stale RF_SHAREABLE bit also persists on free fragments, so a later RF_SHAREABLE request can share a region whose current owner did not request sharing. Kernel-internal caller-contract weakness; hardening. Fix: clear the fields on release/takeover.
Timeline
- 2026-09-02 Discovered during pass-2 audit of subr_rman.c (GLM 5.3).
No comments yet.