ahci_cam_attach() error paths leak the cam_sim and leave the bus registered: ahci_cam_detach() no-ops because AP_F_CAM_ATTACHED is not yet set
Summary
ahci_cam_attach sets AP_F_BUS_REGISTERED only after bus_register succeeds and AP_F_CAM_ATTACHED only after probe succeeds; both error paths call ahci_cam_detach to roll back - but detach returns immediately unless AP_F_CAM_ATTACHED is set. On bus_register failure the freshly allocated cam_sim is never freed; on probe failure the sim leaks AND the already-registered bus is never deregistered, leaving a live bus/sim on a port whose probe failed. Hostile/misbehaving SATA device at attach. Widen-the-guard fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4204 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 172 B | ↓ raw | |
| verdict.json | file | 1.1 KB | view raw |
DF-4204 — ahci_cam_attach error-path sim/bus leak
Guard-flag ordering: detach no-ops before AP_F_CAM_ATTACHED is set. Hardware precondition. PoC skipped per contract.
Fix verification
not_testablewiden the detach guard to cover partially-attached states (AP_F_CAM_ATTACHED|AP_F_BUS_REGISTERED, plus ap_sim==NULL)
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
ahci_cam.c:137-151 error paths call detach; :211-212 detach gates ALL cleanup on AP_F_CAM_ATTACHED set only at :151
Verdict
source-verified; hardware precondition (device failing IDENTIFY at attach; QEMU ide-hd always IDENTIFIES)
No comments yet.