drm_atomic_helper_set_config leaks atomic state object when handle_conflicting_encoders fails
Summary
drm_atomic_helper_set_config() at drm_atomic_helper.c:2938-2940: after drm_atomic_state_alloc, handle_conflicting_encoders(state,true) failure does `return ret;` directly, bypassing fail: label and its drm_atomic_state_put(state). Leaked state also pins every connector/crtc/plane/mode_blob reference. Other helpers (update_plane:2769, page_flip:3382, legacy_gamma_set:4001) all use goto fail. handle_conflicting_encoders returns -EINVAL deterministically when two connectors share encoder (drm_encoder_mask collision). DRM_MASTER-gated SETCRTC ioctl; unprivileged uid can be first master on headless system. Fix: change return ret to goto fail.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1218 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 307 B | view raw |
DF-1218 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
drm_atomic_helper_set_config leaks atomic state object when handle_conflicting_encoders fails
Source Location
sys/dev/drm/drm_atomic_helper.c:2938-2940
Verdict
Source-confirmed: drm_atomic_helper_set_config leaks atomic state object when handle_con. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
drm_atomic_helper_set_config() at drm_atomic_helper.c:2938-2940: after drm_atomic_state_alloc, handle_conflicting_encoders(state,true) failure does return ret; directly, bypassing fail: label and its drm_atomic_state_put(state). Leaked state also pins every connector/crtc/plane/mode_blob reference. Other helpers (update_plane:2769, page_flip:3382, legacy_gamma_set:4001) all use goto fail. handle_conflicting_encoders returns -EINVAL deterministically when two connectors share encoder (drm_encod
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: drm_atomic_helper_set_config returns ret instead of goto fail after handle_conflicting_encoders fails, leaking atomic state object. Fixed to goto fail.
Verified recommended fix
Source-confirmed: drm_atomic_helper_set_config returns ret instead of goto fail after handle_conflicting_encoders fails, leaking atomic state object. Fixed to goto fail.
Verdict
Source-confirmed: drm_atomic_helper_set_config returns ret instead of goto fail after handle_conflicting_encoders fails, leaking atomic state object. Fixed to goto fail.
No comments yet.