DF-4630
mpt_user: shared static user_handler_id over a global reply-handler table — detaching one controller unregisters mpt_user_reply_handler for all others, leaking requests until pool exhaustion
Summary
The handler table is global and dedups by function pointer, so every controller's attach gets the same id into the single file-static; detach deregisters unconditionally - with 2+ HBAs, the survivor's replies route to the default handler, requests never complete, and each RAID_ACTION leaks one of the 512 request slots until ENOMEM takes down all mpt I/O. Refcount-the-registration fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4630 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: hardware-gated (no Intel DSI panel / no mpt HBA on guest)
fix in finding markdown
per-fix-DF-4630
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
File-static user_handler_id over a function-deduped GLOBAL handler table: first detach unregisters the handler still used by the survivor - its replies route to the default handler, requests never complete and leak. Refcount-the-registration fix. Cross-file note: mpt_wait_req can TIMEDOUT-mark an already-completed request (permanent leak class).
Verdict
not_run: no mpt HBA on guest; 2-controller precondition; code path certain
No comments yet.