DF-5790 — device_delete_child() on a probed-but-unattached (DS_ALIVE) device leaks the driver softc

Root cause

device_delete_child() (sys/kern/subr_bus.c:1283-1310) calls device_detach(child) first. For a child that was probed but never attached (state == DS_ALIVE, exactly the state device_probe_child() leaves at sys/kern/subr_bus.c:1486), device_detach() short-circuits:

    if (dev->state != DS_ATTACHED)
        return(0);          /* subr_bus.c:2136-2137 */

without running the teardown at sys/kern/subr_bus.c:2146-2151 — in particular without device_set_driver(dev, NULL), which is the only subr_bus path that frees the softc allocated during probe (sys/kern/subr_bus.c:1952-1954). device_delete_child() then destroys the device object (kobj_delete(child, M_BUS), sys/kern/subr_bus.c:1306), which frees the struct bsd_device only — kobj_delete() (sys/kern/subr_kobj.c:264-273) never touches the softc. The probe softc is leaked.

The probed-but-unattached delete is driven in-tree by the USB bus-explore path (sys/bus/u4b/usb_device.c:1223 creates the temp child, :1415 deletes it, with device_probe_and_attach() in between) and by the async-attach machinery; any driver that deletes children between probe and attach leaks driver->size bytes of M_BUS per cycle.

Build / Run

Same rig as DF-5789 (the KLD also registers driver dfleak, softc size 8192):

cd /root/df5789 && make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC
sh run5790.sh     # 100 control cycles (no probe) + 200 leak cycles

Expected (stock kernel)

• kernel log: DF5790: 100 add/probe/delete cycles ... last child state=1 softc=0xfffff801186b4000 (LEAKED, never kfree'd) (state 1 = DS_ALIVE);
• vmstat -m bus MemUse: 97.6K baseline → 97.7K after control → 898K after 100 probe cycles (+~800K = 100×8192) → 1.66M after 200 — and the 1.66M survives kldunload (permanent).

Fixed kernel (fix.diff: release driver in device_delete_child)

• same 200 probe cycles: 97.7K → 97.7K → 97.7K (zero growth).

Files

rig.c (shared), run.sh (= run5790.sh), run.log, fixrun.log, build.log, fix.diff (also fixes DF-5789).

DF-5790 VERDICT — REPRODUCED (unbounded M_BUS leak per probed-then-deleted device)

Mechanism (line-accurate)

1. device_set_driver(child, drv) during probe allocates the softc — sys/kern/subr_bus.c:1952-1954 (dev->softc = kmalloc(driver->size, M_BUS, M_INTWAIT | M_ZERO)); device_probe_child() leaves the child in DS_ALIVE with driver+softc bound (sys/kern/subr_bus.c:1486).
2. device_delete_child(parent, child) → device_detach(child) → short-circuit if (dev->state != DS_ATTACHED) return(0); (sys/kern/subr_bus.c:2136-2137) — the teardown block at 2146-2151 (which contains the only subr_bus device_set_driver(dev, NULL)) is skipped.
3. kobj_delete((kobj_t)child, M_BUS) (sys/kern/subr_bus.c:1306) → sys/kern/subr_kobj.c:264-273 — frees the device object only; the softc is orphaned → leak of driver->size bytes per cycle.

Baseline result (stock kernel #0) — reproduced

run.log: with driver softc size 8192 —

kernel log: DF5790: ... last child state=1 softc=0xfffff801186b4000 (LEAKED, never kfree'd) — the deleted child was DS_ALIVE with a live softc pointer.

Control run isolates the cause precisely: without the probe (no softc) the identical churn grows M_BUS by ~0.1K total.

Impact

Unbounded kernel heap leak (M_BUS), permanent for the uptime. In-tree reachability today is narrow (USB temp_dev deletes between probe and attach; async-attach window; any third-party/newbus driver deleting children in the probed state), so rated Low — but the protocol flaw is certain: the delete path simply does not own the softc.

Fix validation — FIXED

fix.diff: in device_delete_child(), after device_detach(child) succeeds, add

    if (child->driver != NULL)
        device_set_driver(child, NULL);

which releases the driver binding and frees the softc before the object is destroyed. Patched kernel #1 (Oct 12 18:33:11): the identical 200-cycle run shows 97.7K → 97.7K → 97.7K (fixrun.log) — zero growth; the "LEAKED" path is gone (kernel still prints the state=1 softc pointer before delete, but the memory is now reclaimed).

Guest

Same rig/kernel builds as DF-5789; guest reset to clean-source snapshot afterwards.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.