sc_isoc_in_buffer mbuf leaked on device detach: unfreed SCO reassembly buffer enables repeatable mbuf exhaustion
Summary
ubt_detach() drains sc_cmdq/sc_aclq/sc_scoq but never frees sc->sc_isoc_in_buffer, the partial-SCO-reassembly mbuf+cluster (~2KB) that ubt_isoc_read_one_frame() retains (the field is referenced nowhere else in the tree). Unplugging (or malicious-device-detaching) a Bluetooth dongle mid-SCO-frame therefore leaks one mbuf+cluster per attach/detach cycle with partial reassembly state; repeated hotplug cycles drive the system toward mbuf exhaustion (network-wide DoS). Malicious-USB threat model: the device simply starts a SCO frame it never completes, then forces detach. Not executed on guest (no USB Bluetooth dongle; DF-0420/0421 established the surface). Fix: NG_FREE_M(sc->sc_isoc_in_buffer) in ubt_detach under UBT_NG_LOCK + clear in disconnect. [VERIFIED pass2: hardware-gated no USB dongle; buffer-never-freed line-verified; compile-validated in harness kernel]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3490 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 435 B | ↓ raw | |
| VERDICT.md | — | 1.7 KB | ↓ raw | |
| env.txt | — | 309 B | view raw | |
| fix.diff | — | 390 B | view raw | |
| manifest.json | — | 786 B | view raw | |
| run.log | — | 81 B | view raw | |
| verdict.json | — | 1.9 KB | view raw |
DF-3490 - ubt sc_isoc_in_buffer leak on detach
Hardware-gated (USB Bluetooth dongle absent). Source-verified: ubt_detach (ng_ubt.c:684-713) frees cmdq/aclq/scoq but never sc_isoc_in_buffer (only user: ubt_isoc_read_one_frame :1113/:1178). Compile-validated by inclusion in the X86_64_NG7 harness kernel.
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
DF-3490 - VERDICT
status: inconclusive | reproduced: 0 | impact: none | confidence: certain
Not testable at runtime on this guest (no USB Bluetooth dongle can be attached to attach/detach ng_ubt nodes; malicious-USB threat model). Line-accurate confirmation: ubt_detach() (ng_ubt.c:684-713) drains sc_cmdq/sc_aclq/sc_scoq via NG_BT_MBUFQ_DESTROY but never frees sc->sc_isoc_in_buffer and never clears it - the only other reference in the file is ubt_isoc_read_one_frame() retaining it (:1113, :1178); grep of the whole tree shows no other user. Every attach/detach cycle that leaves a partial SCO frame in the reassembly mbuf therefore leaks one mbuf+cluster (~2KB) permanently; repeated hotplug cycles drive toward mbuf exhaustion. ng7 ubt is compiled into the DF verification harness kernel (NETGRAPH7_BLUETOOTH_UBT) to prove the file builds and the fix.diff applies (see build.log in the harness kernel log); runtime leak not exercised - no device.
Kernel references
- sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:684
- sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1113
- sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1178
Evidence
source excerpt ng_ubt.c:684-713 (detach) and :1113/:1178 (retention), harness kernel build.log (module compiled in)
Recommended fix
NG_FREE_M(sc->sc_isoc_in_buffer) under UBT_NG_LOCK in ubt_detach() (and clear on disconnect).
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
source excerpt ng_ubt.c:684-713 (detach) and :1113/:1178 (retention), harness kernel build.log (module compiled in)
PoC changes
none
Verified recommended fix
NG_FREE_M(sc->sc_isoc_in_buffer) under UBT_NG_LOCK in ubt_detach() (and clear on disconnect).
Verdict
Not testable at runtime on this guest (no USB Bluetooth dongle can be attached to attach/detach ng_ubt nodes; malicious-USB threat model). Line-accurate confirmation: ubt_detach() (ng_ubt.c:684-713) drains sc_cmdq/sc_aclq/sc_scoq via NG_BT_MBUFQ_DESTROY but never frees sc->sc_isoc_in_buffer and never clears it - the only other reference in the file is ubt_isoc_read_one_frame() retaining it (:1113, :1178); grep of the whole tree shows no other user. Every attach/detach cycle that leaves a partial SCO frame in the reassembly mbuf therefore leaks one mbuf+cluster (~2KB) permanently; repeated hotplug cycles drive toward mbuf exhaustion. ng7 ubt is compiled into the DF verification harness kernel (NETGRAPH7_BLUETOOTH_UBT) to prove the file builds and the fix.diff applies (see build.log in the harness kernel log); runtime leak not exercised - no device.
No comments yet.