Summary

ttm_pool_shrink_scan() runs from the vm_lowmem eventhandler and, under a function-static mutex, deliberately uses a function-static buffer (static_buf) inside ttm_page_pool_free(..., use_static=true) — the code comment at line 414 asserts this is safe "since global mutex is held". ttm_page_alloc_fini() tears the subsystem down without taking that mutex: it only calls EVENTHANDLER_DEREGISTER (which in DragonFlyBSD, sys/kern/subr_eventhandler.c:115-136, merely unlink-and-kfree under lwkt_token and does NOT wait for in-flight invocations) and then immediately re-enters ttm_page_pool_free(..., use_static=true) per pool, finally kobject_put → kfree(_manager) and _manager=NULL.

The result is two concurrent defects:

1. Both threads write the same static_buf in ttm_page_pool_free and one of them then calls ttm_pages_put(static_buf,...) on corrupted page pointers.
2. The shrinker loop dereferences _manager->pools[i] after _manager has been kfree()'d.

Root cause

ttm_pool_shrink_scan (sys/dev/drm/ttm/ttm_page_alloc.c:385-424) is registered as a vm_lowmem eventhandler at :447-448. Its only serialization is static DEFINE_MUTEX(lock) (:388) taken via mutex_trylock at :401 — the comment at :414 ("OK to use static buffer since global mutex is held") is the explicit correctness argument for passing use_static=true into ttm_page_pool_free at :416.

ttm_page_alloc_fini (:853-866) never takes this mutex: ttm_pool_mm_shrink_fini (:451-454) calls EVENTHANDLER_DEREGISTER(vm_lowmem,...), and eventhandler_deregister in sys/kern/subr_eventhandler.c:115-136 only TAILQ_REMOVE's the entry under lwkt_token and kfrees it — it does NOT synchronize against any concurrent EVENTHANDLER_INVOKE already past the el_entries walk.

After deregistration fini loops:

for (i = 0; i < NUM_POOLS; ++i)
    ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, true);   /* :861-862 */

reusing the SAME static_buf in ttm_page_pool_free:293 while the still-running shrinker on another CPU is mid-flight inside the same function with the same buffer.

The fini path then calls kobject_put(&_manager->kobj) (:864) which triggers ttm_pool_kobj_release:153-158 → kfree(m); the still-running shrinker on the other CPU then re-reads _manager->pools[(i+pool_offset)%NUM_POOLS] at :412 on its next loop iteration against freed memory (or against NULL after :865 executes _manager = NULL).

Threat model

Trigger requires the local actor to initiate TTM subsystem teardown (root-only: ttm_page_alloc_fini is called from ttm_memory.c:368 during TTM global teardown / module unload) while an unprivileged user can independently keep the system under VM pressure so the vm_lowmem event fires repeatedly, widening the race window.

Impact is kernel memory corruption: most likely a kernel panic on a garbage page pointer inside ttm_pages_put → __free_pages, or a NULL/_manager UAF dereference.

Reliable kernel crash (A:H); arbitrary-write escalation is not demonstrated because the corrupted pointers are legitimate vm_page pointers being freed, not attacker-controlled values.

Pre-condition: root-initiated module/subsystem teardown overlapping a vm_lowmem callback. CVSS reflects AC:H (race timing) and PR:H.

PoC

Reproduce recipe (root-triggered DoS; unprivileged pressure widens the window):

1. As unpriv user, run a memory-thrash loop in the background to keep vm_lowmem firing, e.g. a process that mmap(MAP_ANON)/munmap large regions in a tight loop, or malloc/memset churn — this drives repeated invocations of ttm_pool_shrink_scan via EVENTHANDLER_INVOKE(vm_lowmem).

2. As root, in a tight loop load/unload the drm stack (or anything that triggers ttm_page_alloc_fini via ttm_mem_global_fini), e.g.:

sh while true; do kldload <drm_kms> sleep 0.001 kldunload <drm_kms> done

adapted to whatever module houses the TTM init on the device under test.

3. Expected success: kernel panic, signature along the lines of:

fatal trap 12: page fault while in kernel mode ... ttm_pages_put+0x... __free_pages+0x...

with a corrupted pointer from static_buf, or inside ttm_pool_shrink_scan dereferencing freed _manager.

4. To prove the static_buf half specifically, build a kernel with KASAN/UBSAN or sprinkle a delay between spin_unlock_irqrestore at ttm_page_alloc.c:333 and ttm_pages_put at :335 — the panic becomes near-deterministic.

PoC tree layout under findings/poc/DF-1663/: trigger_mempressure.c (the unpriv user churn), run.sh (root loop of kldload/kldunload), expected_panic.txt.

Because the bug is a privilege-gated teardown race, the PoC targets reliable kernel panic; it does not pursue uid0 escalation since the trigger already runs as root.

Recommended fix

Make the shrinker serialization actually cover teardown. Two-part fix:

1. Have ttm_page_alloc_fini take the shrinker mutex before touching the pools so the static_buf invariant holds, and clear _manager under that same mutex so a racing shrinker either sees the valid pointer or bails.
2. Make ttm_pool_shrink_scan re-validate _manager under the mutex on each iteration (or convert the deregister path to a synchronize-style barrier).

Minimal diff against this tree:

--- a/sys/dev/drm/ttm/ttm_page_alloc.c
+++ b/sys/dev/drm/ttm/ttm_page_alloc.c
@@ -385,6 +385,7 @@ static unsigned long
 ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
 {
    static DEFINE_MUTEX(lock);
+   struct ttm_pool_manager *mgr;
    static unsigned start_pool;
    unsigned i;
    unsigned pool_offset;
@@ -401,8 +402,12 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)

    if (!mutex_trylock(&lock))
        return SHRINK_STOP;
+   mgr = _manager;
+   if (!mgr)
+       goto out_unlock;
    pool_offset = ++start_pool % NUM_POOLS;
    /* select start pool in round robin fashion */
    for (i = 0; i < NUM_POOLS; ++i) {
@@ -412,7 +417,7 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
        if (shrink_pages == 0)
            break;

-       pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
+       pool = &mgr->pools[(i + pool_offset)%NUM_POOLS];
        page_nr = (1 << pool->order);
        /* OK to use static buffer since global mutex is held. */
        nr_free_pool = roundup(nr_free, page_nr) >> pool->order;
@@ -422,7 +427,10 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
            break;
        shrink_pages <<= pool->order;
    }
+out_unlock:
    mutex_unlock(&lock);
    return freed;
 }
@@ -451,8 +459,10 @@ ttm_pool_mm_shrink_init(struct ttm_pool_manager *manager)

 static void ttm_pool_mm_shrink_fini(struct ttm_pool_manager *manager)
 {
+   extern struct lock /* shrink mutex is file-static; see note */;
    EVENTHANDLER_DEREGISTER(vm_lowmem, manager->lowmem_handler);
+   /* caller (ttm_page_alloc_fini) must serialize against shrink_scan */
 }
@@ -853,9 +863,17 @@ void ttm_page_alloc_fini(void)
 {
    int i;

+   /*
+    * The shrinker's static_buf is only safe while the shrink mutex is
+    * held; acquire it here so a racing vm_lowmem callback cannot reuse
+    * the same buffer or dereference _manager after we free it.
+    */
+   ttm_pool_shrink_lock_acquire();
    pr_info("Finalizing pool allocator\n");
    ttm_pool_mm_shrink_fini(_manager);

    /* OK to use static buffer since global mutex is no longer used. */
    for (i = 0; i < NUM_POOLS; ++i)
        ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, true);

    kobject_put(&_manager->kobj);
    _manager = NULL;
+   ttm_pool_shrink_lock_release();
 }

where ttm_pool_shrink_lock_acquire/release wrap the existing static DEFINE_MUTEX (expose it via a small helper, or convert the static mutex to a file-scope named struct lock and lockmgr it). A cleaner long-term fix is to remove use_static entirely from the fini path (pass false so each free kmallocs its own buffer) and to gate _manager dereference in ttm_pool_shrink_scan on the mutex combined with a NULL check, as sketched above.