Unbounded softc/cdev/tag allocation from remote LNK_SPANs, and span-loss termination disabled (#if 0): devices never reclaimed, kldunload xdisk permanently EBUSY
Summary
Each LNK_SPAN with a distinct pfs_label allocates a softc, 64 tags, a cdev and a devstat with no cap (the unit scan is even O(N^2)); the span-DELETE call site of xa_terminate_check is compiled out (#if 0). Once all spans vanish and nobody opens it, the softc and /dev/xaN persist forever and the RB tree blocks unload permanently. DEMONSTRATED LIVE: 100 spans -> 100 devices; after all deletes + peer exit all 100 nodes persist, unload EBUSY, ~1.45MB retained. Re-enable-terminate + cap fix (policy choice).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4383 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| xdpeer.c | — | 15.0 KB | view raw | |
| run.log | — | 322 B | view raw | |
| run.2.log | — | 213 B | view raw | |
| env.txt | — | 145 B | view raw |
Fix verification
not_testableNo fix built: the remedy is an upstream policy decision (re-enable termination on span loss + cap devices); behavior documented live.
run.log / run.2.log
Confirmed kernel references
Detail
Exploit chain
root attaches to peer once -> peer sends N distinct-label spans -> N immortal softcs/devices/kernel memory; module unload blocked forever. Availability/resource exhaustion only.
Evidence (decisive lines)
run.log (flood + census + EBUSY + vmstat -m), run.2.log
PoC changes
authored fresh (xdpeer flood mode); teardown waits for probe quiescence and deletes spans explicitly to avoid stepping on the known DF-2532 panic
Verified recommended fix
re-enable xa_terminate_check on span delete (or deferred callout) and cap xa unit count / total spans accepted per iocom
Verdict
One softc + 64 tags + cdev + devstat per distinct-pfs_label LNK_SPAN with no cap, and termination on span loss is #if 0-ed out (xdisk.c:558-564), so softcs/devices are never reclaimed after the peer disconnects: 100 devices created and retained after clean span teardown on the guest, kldunload xdisk permanently EBUSY, ~1.45MB kernel memory for 100 spans. Remote peer can drive this without bound.
No comments yet.