β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-1208

intel_runtime_pm_get_if_in_use() returns true without taking wakeref on DragonFly, causing unbalanced put() underflow

Summary

intel_runtime_pm_get_if_in_use() at intel_runtime_pm.c:4039-4064 guards atomic_inc(&wakeref_count) inside #ifndef __DragonFly__ on DFly. Function returns true but never increments. intel_runtime_pm_put() at :4106-4116 NOT guarded, always decrements. Every intel_display_power_get_if_enabled() call where domain is disabled -> put() decrements unincremented counter -> underflow wraps negative->large-positive -> permanently silences assert_rpm_wakelock_held(). DFly-specific pm_runtime stubs are no-ops so no real power transition/UAF. Impact: assertion defeat + WARN_ONCE only. Fix: move #endif above atomic_inc so wakeref bookkeeping runs on DFly, matching get()/put() pattern.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1208 Β· 1 files
FileTypeDescriptionSize
manifest.json file 402 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/dev/drm/i915/intel_runtime_pm.c:4039: get_if_in_use returns true without taking wakeref (unbalanced put underflow)

Verified recommended fix

Source-confirmed at sys/dev/drm/i915/intel_runtime_pm.c:4039: get_if_in_use returns true without taking wakeref (unbalanced put underflow)

Verdict

Source-confirmed at sys/dev/drm/i915/intel_runtime_pm.c:4039: get_if_in_use returns true without taking wakeref (unbalanced put underflow)