DF-4954

mpr_pci_setup_interrupts: bus_setup_intr failure truncates msi_msgs before the failing queue, permanently leaking its allocated IRQ resource and (via ignored EBUSY) the MSI message

Summary

The error branch rewrites the loop bound the teardown depends on instead of releasing the just-allocated irq - the failing queue's SYS_RES_IRQ is never released and pci_release_msi hits EBUSY (ignored). Rman+vector exhaustion on attach-error/retry. Hw-gated. Release-before-break fix.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — drivers
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
CWE: CWE-772
File: sys/dev/raid/mpr/mpr_pci.c
Lines: 294-362
Area: dev
Discovered: 2026-09-25
Updated: 2026-09-25

Team triage

untriaged

priority: — · owner: —

PoC verification

untested

Status: untested
Reproduced: no
Impact: leak
Confidence: certain
Tested: 2026-09-25 10:19:07
Attempts: 0
Runtime: —
Code hash: —
Guest: —
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-09-25 10:19:07
Runtime: —
Kernel: per-fix-DF-4954
fix.diff: findings/poc/DF-4954/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4954 · 1 files

File	Type	Description	Size
verdict.json	file		1.0 KB	view raw

Fix verification

not_testable

per-fix-DF-4954

Confirmed kernel references

Detail

Exploit chain

attach-time bus_setup_intr failure under irq/vector pressure -> truncated msi_msgs skips queue i in every teardown -> IRQ rle + MSI message leaked for the device lifetime, blocking re-attach

Evidence (decisive lines)

findings/poc/DF-4954/ (this verdict; code-trace proof)

Verdict

Hardware-gated (no MPT3 HBA on guest): bus_setup_intr failure sets msi_msgs=i BEFORE releasing the just-allocated q->irq for queue i - every teardown loop iterates ires!=NULL -> EBUSY (ignored), so the MSI message leaks too. Rman resource + vector exhaustion on attach-error/retry paths. Release-before-break fix (mirrors upstream mps/mpr).