ichsmb_attach error path: lockuninit() runs while the interrupt handler is still registered and the smbus child is leaked
Summary
If bus_generic_attach fails after setup_intr succeeded, the fail label lockuninits the mutex with the ISR still live on a possibly shared IRQ (it takes the destroyed lock) and the smbus child is never deleted - window persists until the PCI frontend releases resources. The ig4 DF-1049 class. Teardown-before-uninit fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5460 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 988 B | ↓ raw | |
| verdict.json | file | 1.3 KB | view raw |
DF-5460 — ichsmb_attach error path: lockuninit() while the ISR is still registered; smbus child leaked (trace-only pack)
If bus_generic_attach() fails (ichsmb.c:132-135) after bus_setup_intr()
succeeded (ichsmb.c:124-129), the fail label runs lockuninit(&sc->mutex)
(ichsmb.c:140) with the interrupt handler still live, and the sc->smb
child added at ichsmb.c:114 is never deleted. The window until the PCI
frontend's ichsmb_release_resources() (ichsmb_pci.c:265) tears down the
irq is small but real: the ISR takes the destroyed lock (ichsmb.c:505) ->
panic/UAF on a shared irq. Mirror of ig4 sibling DF-1049 (attach-error-path
leak class).
Not verified live (requires forcing a child-attach failure at boot with the controller interrupting — config/hardware dependent; severity Info/Low). Fix sketch: on the bus_generic_attach failure path, teardown_intr + delete child before lockuninit (or rely solely on ichsmb_release_resources ordering after lockuninit removal).
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
README.md trace; ichsmb.c:114,124-135,140; ichsmb_pci.c:255-266
Verified recommended fix
In the bus_generic_attach failure path, tear down the irq and delete sc->smb before lockuninit.
Verdict
Trace-proven error-path defect (ichsmb.c:132-141: lockuninit with live ISR + leaked smbus child) not exercised live: forcing bus_generic_attach failure while the shared IRQ fires is config/hardware dependent and not reproducible on the QEMU rig. Info/Low severity, privileged config-time window.
No comments yet.