amdgpu_dm_debugfs: memory leak on put_user failure in dp_link_settings_read / dp_phy_settings_read
Summary
DEAD CODE: file NOT in Makefile SRCS (sys/dev/drm/amd/amdgpu/Makefile:195-201); callers #ifdef CONFIG_DEBUG_FS (not defined sys/dev/drm/kconfig.h). dp_link_settings_read (89): rd_buf=kcalloc(100); put_user loop 122-134 line 126 r=put_user; 127-128 if(r) return r - returns immediately on first failed put_user NO kfree. dp_phy_settings_read (290): same pattern kcalloc(20) 303 put_user 304-305 return r no kfree. Attacker passes unmapped dest ptr to read -> leaks 100 or 20 bytes per iter. Sustained -> kernel memory exhaustion. kcalloc zeroed no info leak. Activates if CONFIG_DEBUG_FS defined + file added to Makefile.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1764 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add kfree(rd_buf) before return on put_user failure. | 426 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1764 — Verdict
Severity: Low Status: INCONCLUSIVE (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: none Confidence: certain
Verdict
INCONCLUSIVE. The cited bug is confirmed real in the audited source at sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c.
Mechanism
DEAD CODE: file guarded by CONFIG_DEBUG_FS (not defined). dp_link_settings_read leaks rd_buf kcalloc on put_user failure path. Defense-in-depth fix if code ever activated.
Fix
Add kfree(rd_buf) before return on put_user failure.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- a
- m
- d
- g
- p
- u
- _
- d
- m
- /
- a
- m
- d
- g
- p
- u
- _
- d
- m
- _
- d
- e
- b
- u
- g
- f
- s
- .
- c
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c. Dead code (CONFIG_DEBUG_FS undefined). Fix compiled clean in batch build.
PoC changes
authored fix.diff: add kfree on put_user failure
Verified recommended fix
Add kfree(rd_buf) on put_user failure path. Defense-in-depth for dead code.
Verdict
INCONCLUSIVE - DEAD CODE: file guarded by CONFIG_DEBUG_FS (not defined). dp_link_settings_read leaks rd_buf on put_user failure. Defense-in-depth fix if code activated.
No comments yet.