DF-2864
Per-candidate struct mount + syncer-thread leak and permanent vfc_refcount leak on failed root-mount attempts (mp overwritten next iteration; error path never drops mp->mnt_vfc->vfc_refcount)
| Field | Value |
|---|---|
| ID | DF-2864 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-401 Missing Release of Memory |
| File | sys/kern/vfs_conf.c |
| Lines | 435-465, 507-511 (contrast :375) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
In the vfs_mountroot_try candidate loop, when candidate N passes vfs_rootmountalloc but VFS_MOUNT fails, the next iteration's vfs_rootmountalloc overwrites mp without teardown: the previous struct mount leaks with its live syncer kernel thread, shared-locked mnt_lock, and mnt_hold=1 — unreclaimable. Additionally the final error path never drops mp->mnt_vfc->vfc_refcount (unlike the devfs error path at :375), so each failed attempt permanently pins the fstype's vfsconf — vfsconf_remove() refuses module unload forever. Bounded by candidate count; boot-time only. Hardening/correctness. Fix: tear down the failed mp inside the loop + the refcount drop on the error path.
Timeline
- 2026-09-02 Discovered during pass-2 audit of vfs_conf.c (GLM 5.3).
No comments yet.