Memory leaks on udf_mountfs/udf_vget error paths: s_table freed only in udf_unmount, unode->fentry leaked when udf_allocv fails
Summary
udf_mountfs' bail path (:393-395) frees udfmp but never udfmp->s_table, which udf_find_partmaps (:662) may have allocated before the mount subsequently fails (invalid sparing table :684-687; readlblks failure :673-679; multiple type-2 maps leak all but the last) - repeated failed mounts of crafted images leak a kmalloc(st_size) chunk each. Symmetrically, udf_vget (:535-538) kfrees unode but leaks unode->fentry when udf_allocv fails after the fentry kmalloc (:528). The MNT_UPDATE-successful-remount leak of the entire old udf_mnt is covered by DF-3164's fix. Resource-exhaustion by repeated failing mounts (mount privilege); no memory-safety impact. Not run (Low). Fix: free the sub-objects on the error paths. [VERIFIED pass2: UDF forger beyond batch budget; both leaks line-certain; fix compile-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3166 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | — | 578 B | view raw | |
| README.md | — | 385 B | ↓ raw | |
| VERDICT.md | — | 1.8 KB | ↓ raw | |
| build.sh | — | 144 B | view raw | |
| run.sh | — | 88 B | view raw | |
| manifest.json | — | 536 B | view raw | |
| verdict.json | — | 1.5 KB | view raw | |
| fix.diff | — | 578 B | view raw | |
| env.txt | — | 272 B | view raw |
DF-3166 -- verification pack
Finding: udf_mountfs/udf_vget error paths leak s_table / fentry
Status: not_reproduced / impact leak / confidence certain
What was run
n/a (UDF image forger out of batch budget)
How to reproduce
n/a
Expected
n/a
See VERDICT.md for the full narrative and verdict.json for the persisted machine verdict. Artifacts: fix.diff.
DF-3166 verification
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Bottom line
Both leaks are line-certain from source: the udf_mountfs bail path at :393-395 frees udfmp but never udfmp->s_table, which udf_find_partmaps allocates before any late mount failure (invalid sparing table, readlblks failure, multiple type-2 maps leak all but the last), and udf_vget at :535-538 kfrees unode but leaks unode->fentry kmalloced at :528 when udf_allocv fails. A dynamic demonstration requires a crafted UDF image with a valid sparable-partition map that fails later in mount (root file-entry corruption); building a UDF forger exceeded this batch budget, and the udf_vget half additionally requires an allocation failure. Fix frees both; compile-validated in the combined build.
Kernel references
- sys/vfs/udf/udf_vfsops.c:393-395
- sys/vfs/udf/udf_vfsops.c:528
- sys/vfs/udf/udf_vfsops.c:535-538
- sys/vfs/udf/udf_vfsops.c:662
Exploit chain
(none: availability/correctness finding; no privilege chain)
Fix
free s_table in the bail path and fentry on the udf_allocv failure
See fix.diff in this directory (git-apply-able against the read-only sys/ tree; applied only inside the disposable verification guest).
Reproduction
build: n/a (UDF image forger out of batch budget)
run: n/a
expected: n/a
Notes on the PoC (what changed vs the finding sketch)
(none)
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md walk over udf_vfsops.c:393-395/:528/:535-538 and udf_find_partmaps :662/:684-687
Verified recommended fix
free s_table in the bail path and fentry on the udf_allocv failure
Verdict
Both leaks are line-certain from source: the udf_mountfs bail path at :393-395 frees udfmp but never udfmp->s_table, which udf_find_partmaps allocates before any late mount failure (invalid sparing table, readlblks failure, multiple type-2 maps leak all but the last), and udf_vget at :535-538 kfrees unode but leaks unode->fentry kmalloced at :528 when udf_allocv fails. A dynamic demonstration requires a crafted UDF image with a valid sparable-partition map that fails later in mount (root file-entry corruption); building a UDF forger exceeded this batch budget, and the udf_vget half additionally requires an allocation failure. Fix frees both; compile-validated in the combined build.
No comments yet.