⬢ DragonFlyBSD Kernel Audit
DF-4579 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-4579",
  "title": "radeon: every failed PCI attach leaks one drm_device — DragonFly's drm_get_pci_dev has its error unwind #if 0'd out (upstream err_free: drm_dev_unref deleted); radeon_drv.c:433 is the only live caller",
  "verdict": "not_reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "(no build required — defect is in shipped kernel/KLD code)",
    "run": "on ATI hardware: kldload radeon (or boot) with a load failure ('Fatal error during GPU init', radeon_kms.c:137); repeat kldload/unload — each failed attach leaks one struct drm_device. Guest here has no ATI VGA so the path cannot run.",
    "expected": "baseline: unbounded drm_device leak across repeated failed attaches; with fix.diff applied: no leak"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_drv.c:382-434",
    "sys/dev/drm/radeon/radeon_drv.c:812-839",
    "sys/dev/drm/radeon/radeon_drv.c:879-880",
    "sys/dev/drm/drm_pci.c:309-357",
    "sys/dev/drm/drm_pci.c:318",
    "sys/dev/drm/drm_pci.c:338-357",
    "sys/dev/drm/drm_drv.c:789",
    "sys/dev/drm/drm_drv.c:877-924",
    "sys/dev/drm/radeon/radeon_kms.c:95-173"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "env.txt",
    "run.log",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}