DF-5804
gsignal() leaks the pgfind() reference β permanent pgrp/session leak if ever called
Summary
gsignal calls pgfind(pgid) which returns a held reference that must be released with pgrel (documented kern_proc.c:694-698; every other caller pairs them) and never pgrel()s, while pgsignal takes and drops its own separate reference β each call leaks one pg_refs and the pgrp plus its session reference can never be reclaimed. No in-tree callers today (dead exported symbol): latent leak filed so the symbol is fixed before someone wires it up. pgrel-after-pgsignal fix proposed.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5804 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1000 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5804
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace vs pgfind/pgrel contract kern_proc.c:637-720
Verified recommended fix
pgrel after pgsignal
Verdict
untested (inspection-only finding; dead kernel symbol / hardening item - Phase V not applicable per contract)
No comments yet.