intel_runtime_pm_get_if_in_use() returns true without taking wakeref on DragonFly, causing unbalanced put() underflow
Summary
intel_runtime_pm_get_if_in_use() at intel_runtime_pm.c:4039-4064 guards atomic_inc(&wakeref_count) inside #ifndef __DragonFly__ on DFly. Function returns true but never increments. intel_runtime_pm_put() at :4106-4116 NOT guarded, always decrements. Every intel_display_power_get_if_enabled() call where domain is disabled -> put() decrements unincremented counter -> underflow wraps negative->large-positive -> permanently silences assert_rpm_wakelock_held(). DFly-specific pm_runtime stubs are no-ops so no real power transition/UAF. Impact: assertion defeat + WARN_ONCE only. Fix: move #endif above atomic_inc so wakeref bookkeeping runs on DFly, matching get()/put() pattern.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1208 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 402 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/drm/i915/intel_runtime_pm.c:4039: get_if_in_use returns true without taking wakeref (unbalanced put underflow)
Verified recommended fix
Source-confirmed at sys/dev/drm/i915/intel_runtime_pm.c:4039: get_if_in_use returns true without taking wakeref (unbalanced put underflow)
Verdict
Source-confirmed at sys/dev/drm/i915/intel_runtime_pm.c:4039: get_if_in_use returns true without taking wakeref (unbalanced put underflow)
No comments yet.