drm_connector_cleanup on never-initialized connector in amdgpu_connector_add error path
Summary
amdgpu_connector_add failed: at amdgpu_connectors.c:1902: drm_connector_cleanup(connector). All 6 goto-failed sites (:1580/1712/1762/1804/1846/1867) are BEFORE drm_connector_init. kzalloc zeroes list_heads. drm_connector_cleanup list_for_each_entry_safe derefs NULL probed_modes.next -> panic. OOM during connector init. Sibling of DF-1343 (radeon same pattern). Fix: kfree instead of cleanup.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1441 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 937 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 357 B | view raw |
DF-1441 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
drm_connector_cleanup on never-initialized connector in amdgpu_connector_add error path
Source Location
sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:1902-1904
Verdict
Source-confirmed: drm_connector_cleanup on never-initialized connector in amdgpu_connect. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
amdgpu_connector_add failed: at amdgpu_connectors.c:1902: drm_connector_cleanup(connector). All 6 goto-failed sites (:1580/1712/1762/1804/1846/1867) are BEFORE drm_connector_init. kzalloc zeroes list_heads. drm_connector_cleanup list_for_each_entry_safe derefs NULL probed_modes.next -> panic. OOM during connector init. Sibling of DF-1343 (radeon same pattern). Fix: kfree instead of cleanup.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: amdgpu_connector_add failed: label calls drm_connector_cleanup on never-initialized connector. Removed premature cleanup. HW-gated.
Verified recommended fix
Source-confirmed: amdgpu_connector_add failed: label calls drm_connector_cleanup on never-initialized connector. Removed premature cleanup. HW-gated.
Verdict
Source-confirmed: amdgpu_connector_add failed: label calls drm_connector_cleanup on never-initialized connector. Removed premature cleanup. HW-gated.
No comments yet.