ttm_bo_vm: BO kref leak on each mmap of already-mapped BO (kernel memory exhaustion DoS)
Summary
Every mmap of TTM BO calls ttm_bo_vm_lookup (420 ttm_bo_get_unless_zero increments bo->kref). Success path of ttm_bo_mmap_single (800-807) returns without ever calling ttm_bo_put. cdev_pager_allocate (vm/device_pager.c:130-164) on existing vm_obj only increments vm_obj refcount does NOT consume BO kref; ttm_bo_vm_ctor (727-746) no-op for TTM. Only release site ttm_bo_vm_dtor (748-754) fires exactly once per vm_obj lifetime. N mmaps of same BO leak N-1 BO krefs. BO never freed even after GEM handle closed + all mmaps unmapped; drm_vma_offset_remove never runs; backing pages pinned forever. /dev/dri/cardN access -> create dumb -> map dumb offset -> mmap N times -> destroy -> BO leaks.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1728 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add ttm_bo_put(bo) on the mmap_single success path. | 319 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1728 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: dos Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/ttm/ttm_bo_vm.c:800-807.
Mechanism
ttm_bo_mmap_single calls ttm_bo_get_unless_zero (increments kref) but success path never calls ttm_bo_put; N mmaps of same BO leak N-1 krefs, pinning backing pages forever.
Fix
Add ttm_bo_put(bo) on the mmap_single success path.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
drm/ttm sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- t
- t
- m
- /
- t
- t
- m
- _
- b
- o
- _
- v
- m
- .
- c
- :
- 8
- 0
- 0
- -
- 8
- 0
- 7
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/ttm/ttm_bo_vm.c:800-807. Fix compiled clean.
PoC changes
authored fix.diff: add ttm_bo_put(bo) on success path
Verified recommended fix
Add ttm_bo_put on mmap_single success path. Matches finding proposal.
Verdict
REPRODUCED (source-only). ttm_bo_mmap_single increments kref but success path never puts; N mmaps leak N-1 krefs, pinning pages forever.
No comments yet.