lnc PCI detach/unwind never frees the ifmedia list — small kernel memory leak per attach/detach cycle
Summary
lance_config allocates ifmedia entries per medium but neither detach (bare ether_ifdetach) nor the failed-attach unwind calls ifmedia_removeall - ~150-200 bytes leaked per cycle; identical pattern in pcn(4), fix belongs family-wide. ifmedia_removeall-before-detach fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4845 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
kldload/kldunload if_lnc cycles (or hostile NIC attach-fail + rescan retry) -> monotonic ifmedia_entry growth
Evidence (decisive lines)
findings/poc/DF-4845/ (this verdict)
Verdict
Small privileged leak: le_pci_attach -> am79900_config -> lance_config calls ifmedia_init + ifmedia_add per medium (6 entries for PCnet-PCI, each kmallocing an ifmedia_entry), but neither the detach path (am79900_detach is a bare ether_ifdetach) nor the failed-attach unwind ever calls ifmedia_removeall - ~150-200 bytes leaked per attach/detach cycle (kldunload, devctl detach, or attach failure under the hostile-PCI model with driver retry on rescan). Identical pattern in pcn(4) - fix belongs family-wide. ifmedia_removeall-before-ether_ifdetach fix.
No comments yet.