siba_bwn_attach leaks the MMIO BAR, bus mastering and scanned child devices when siba_core_attach fails (bad-SPROM CRC or unsupported-PHY child)
Summary
No unwind on 'return siba_core_attach(siba)' - and that call fails from hardware data (bad-SPROM CRC -> EPROTO; the bwn child rejects e.g. BCM4312 LP-PHY). newbus never detaches a failed attach: the BAR, busmaster, and scanned children leak until reboot and kldunload/re-probe cannot reclaim them. Hardware-gated attach DoS. Unwind fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4866 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.1 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
BCM43xx card with corrupt SPROM or unsupported PHY -> attach fails after BAR alloc -> permanent MMIO window + device leak
Evidence (decisive lines)
findings/poc/DF-4866/ (this verdict)
Verdict
Hardware-gated attach leak: siba_bwn_attach enables busmaster and allocates the backplane BAR, then does 'return siba_core_attach(siba)' with no unwind - and siba_core_attach can fail from hardware data (bad-SPROM CRC propagates EPROTO; the bwn child rejects unsupported PHYs like the common BCM4312 LP-PHY). newbus never detaches a failed attach, so the MMIO BAR, busmaster, and every scanned child leak until reboot; kldunload/re-probe cannot reclaim. No Broadcom NIC on the guest. Unwind-on-failure fix.
No comments yet.