DF-4655
twa_bus_scan_cb frees the scan ccb with the wrong malloc type and leaks its timeout_ch callout on every bus scan
Summary
kfree(ccb, M_TEMP) vs xpt_alloc_ccb's M_CAMXPT allocation plus the separate timeout_ch callout that xpt_free_ccb would free - one callout leaked per scan and malloc accounting corrupted. Scans run at attach and after EVERY controller reset (the watchdog reset loop leaks unboundedly on flaky hardware). xpt_free_ccb fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4655 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: no 3ware hardware on guest
fix in finding markdown
per-fix-DF-4655
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
kfree(ccb, M_TEMP) vs xpt_alloc_ccb's M_CAMXPT + separate timeout_ch alloc that xpt_free_ccb frees. Bus scans run at attach and after EVERY controller reset - a flaky controller under the watchdog loop leaks unboundedly. xpt_free_ccb fix.
Verdict
not_run: needs 3ware 9xxx hardware (resets trigger rescans); defect certain by inspection vs cam_xpt alloc/free pairing
No comments yet.