vpo_attach error paths never unwind the low-level attach (leaked microseq buffer, ppbus left claimed) and the driver has no detach method at all
Summary
vpoio/imm attach kmalloc + claim the ppbus before CAM registration, all three failure exits skip the unwind (in-source XXX admits it), and no detach method or low-level detach exists anywhere - the ppbus stays permanently claimed (lpt/ppi unusable) even deliberately. Add detach + unwind fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4899 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 915 B | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
ZIP present + CAM alloc failure at attach -> microseq leak + ppbus permanently claimed
Evidence (decisive lines)
findings/poc/DF-4899/ (this verdict)
Verdict
Hardware-gated: vpoio/imm_attach kmalloc the microseq buffer and claim the ppbus BEFORE vpo_attach proceeds to CAM registration, but all three CAM failure exits skip the unwind (the in-source XXX admits it) and the driver registers NO detach method (and no vpoio_detach/imm_detach exists anywhere) - so on failure the M_DEVBUF buffer leaks and the ppbus stays permanently claimed (lpt/ppi unusable until reboot); even deliberate release is impossible. Add low-level detach + unwind fix.
No comments yet.