NetBSD Problem Report #60752

From www@netbsd.org  Sun Sep 20 11:29:36 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id BBE2D1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 20 Sep 2026 11:29:35 +0000 (UTC)
Message-Id: <20260920112934.8773D1A923C@mollari.NetBSD.org>
Date: Sun, 20 Sep 2026 11:29:34 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: compat32: memory leak in netbsd32_do_semop error branch
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60752
>Category:       kern
>Synopsis:       compat32: memory leak in netbsd32_do_semop error branch
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Sep 20 11:30:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Fri Oct 02 03:24:54 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
The Compat32 Kmemoryleak, Inc.
>Environment:
>Description:

	Missing kmem_free in error branch with timeout argument:

    226 	if (nsops <= SMALL_SOPS) {
    227 		sops = small_sops;
    228 	} else if (seminfo.semopm > 0 && nsops <= (size_t)seminfo.semopm) {
    229 		sops = kmem_alloc(nsops * sizeof(*sops), KM_SLEEP);
    230 	} else {
    231 		SEM_PRINTF(("too many sops (max=%d, nsops=%zu)\n",
    232 		    seminfo.semopm, nsops));
    233 		return (E2BIG);
    234 	}
...
    246 	if (utimeout) {
    247 		error = copyin(utimeout, &ts32, sizeof(ts32));
    248 		if (error) {
    249 			SEM_PRINTF(("error = %d from copyin(%p, %p, %zu)\n",
    250 			    error, utimeout, &ts32, sizeof(ts32)));
    251 			return error;
    252 		}

	https://nxr.netbsd.org/xref/src/sys/compat/netbsd32/netbsd32_ipc.c?r=1.23#251

>How-To-Repeat:

	code inspection

>Fix:

	consolidate error branches (or, better, start using
	__attribute__((cleanup(...))))

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60752 CVS commit: src/sys/compat/netbsd32
Date: Sun, 20 Sep 2026 13:41:39 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:41:39 UTC 2026

 Modified Files:
 	src/sys/compat/netbsd32: netbsd32_ipc.c

 Log Message:
 compat32 semop: Fix leak on timeout copyin.

 PR kern/60752: compat32: memory leak in netbsd32_do_semop error
 branch


 To generate a diff of this commit:
 cvs rdiff -u -r1.23 -r1.24 src/sys/compat/netbsd32/netbsd32_ipc.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Fri, 02 Oct 2026 03:24:54 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11 and pullup-10


>Unformatted:

Home	PR Database Search