amdgpu_gem: amdgpu_gem_object_open ignores amdgpu_vm_bo_add OOM failure, returns success without bo_va
Summary
amdgpu_gem_object_open at amdgpu_gem.c:143-148: bo_va=amdgpu_vm_bo_find; if(!bo_va) bo_va=amdgpu_vm_bo_add(adev,vm,abo); -- return value UNUSED. amdgpu_vm_bo_add at amdgpu_vm.c:2424-2441 returns NULL on kzalloc GFP_KERNEL failure. amdgpu_bo_unreserve then return 0 (unconditional success). GEM handle published with no bo_va. Subsequent GEM_VA returns -ENOENT (clean). close tolerates NULL via amdgpu_vm_bo_find. Robustness/DoS-class contract violation under memory pressure: unbounded half-init handles.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1720 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Check bo_va for NULL after amdgpu_vm_bo_add and return -ENOMEM. | 362 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1720 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: none Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/amd/amdgpu/amdgpu_gem.c:143-148.
Mechanism
amdgpu_gem_object_open ignores NULL return from amdgpu_vm_bo_add (kzalloc failure); GEM handle published with no bo_va, contract violation under memory pressure.
Fix
Check bo_va for NULL after amdgpu_vm_bo_add and return -ENOMEM.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
amdgpu sources compiled with -Werror in nativekernel.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- a
- m
- d
- g
- p
- u
- /
- a
- m
- d
- g
- p
- u
- _
- g
- e
- m
- .
- c
- :
- 1
- 4
- 3
- -
- 1
- 4
- 8
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/amd/amdgpu/amdgpu_gem.c:143-148. Fix compiled clean.
PoC changes
authored fix.diff: check bo_va NULL return -ENOMEM
Verified recommended fix
Check bo_va for NULL after amdgpu_vm_bo_add. Matches finding proposal.
Verdict
REPRODUCED (source-only). amdgpu_gem_object_open ignores NULL from amdgpu_vm_bo_add; GEM handle with no bo_va under memory pressure.
No comments yet.