DF-4483
build_rq_buffer malloc-failure path frees the whole request via abortrequest() and then every caller frees it again (latent double-free / UAF)
Summary
If the data Malloc failed, abortrequest runs freerq freeing the request and rqgroups - then bre calls deallocrqg on the freed group and vinumstart's ENOMEM path calls freerq again, plus biodone on a buffer whose resources are gone. Dead code today (Malloc is M_WAITOK, never fails) but an immediate heap double-free the day any Malloc in this path switches to M_NOWAIT. Single-owner fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4483 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 874 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
fix in finding markdown
per-fix-DF-4483
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Mixed ownership between abortrequest-freerq and the callers' ENOMEM cleanup. Drop-the-abortrequest fix in finding markdown.
Verdict
not_run: allocation cannot fail on stock kernels; immediate double-free the day any Malloc in this path switches to M_NOWAIT
No comments yet.