DF-5373
bus_dmamap_create() leaks the freshly kmalloc'd map when the initial bounce-page allocation partially fails (vkernel never got pc64's kfree(*mapp) error-path fix)
Summary
*mapp kmalloc'd before the bounce top-up; ENOMEM returns with map_count not incremented and the map never freed - callers treat failed create as no-map, leaking 72B M_DEVBUF per call, exhaustible to vkernel DoS under lowaddr pressure + NOWAIT creates. pc64 fixed exactly this; the fork predates it. kfree-and-NULL-on-error fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5373 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 976 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5373
Confirmed kernel references
Detail
Evidence (decisive lines)
code-certain divergence vs pc64's fixes in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (Medium race / Low leak; needs a bus_dma driver inside a vkernel to exercise)
No comments yet.