Summary

In amdgpu_ctx_init the body of the inner for (j = 0; j < amdgpu_ctx_num_entities[i]; ++j) loop is a single unbraced statement r = drm_sched_entity_init(...). The if (r) goto error_cleanup_entities; that follows is therefore OUTSIDE the loop. If any entity init except the LAST one fails (-ENOMEM from drm_sched_entity_init), the error is silently overwritten by the next iteration and the ctx is returned fully "initialized" with a partially-init sched entity whose rq_list is NULL and whose job_queue was never spsc_queue_init'd.

Root cause

amdgpu_ctx.c:174-178:

for (j = 0; j < amdgpu_ctx_num_entities[i]; ++j)
    r = drm_sched_entity_init(&ctx->entities[i][j].entity,
                  rqs, num_rings, &ctx->guilty);
if (r)
    goto error_cleanup_entities;

The intent was for(j){ r=...; if(r) goto err; }. Without braces, only the assignment is looped; if (r) runs once after the loop with r = the LAST iteration's return code. drm_sched_entity_init (sched_entity.c:48-79) returns -ENOMEM when its kcalloc of rq_list fails; it has already done memset(entity,0,...), INIT_LIST_HEAD, and set entity->rq = rq_list[0] before failing, so the entity looks half-alive. The error path is never taken.

Threat model & preconditions

• Attacker position: local user with render-node access triggering AMDGPU_CTX_OP_ALLOC_CTX under severe memory pressure.
• Privileges gained or impact: kernel oops/panic in drm_sched_entity_destroy at teardown (sched_entity.c:302-305 → drm_sched_entity_fini at :263 dereferencing rq->sched and calling drm_sched_rq_remove_entity on a never-added entity). The failed entity has no job_queue so it cannot be used to push jobs. Local DoS under memory pressure.
• Required config or capabilities: device amdgpu; render node access.
• Reachability: allocate ctx under OOM so one inner drm_sched_entity_init fails but the last one succeeds.

Recommended fix

Add braces so each iteration's return code is checked.

--- a/sys/dev/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_ctx.c
@@ -171,9 +171,12 @@
            break;
        }

-       for (j = 0; j < amdgpu_ctx_num_entities[i]; ++j)
-           r = drm_sched_entity_init(&ctx->entities[i][j].entity,
-                         rqs, num_rings, &ctx->guilty);
+       for (j = 0; j < amdgpu_ctx_num_entities[i]; ++j) {
+           r = drm_sched_entity_init(&ctx->entities[i][j].entity,
+                         rqs, num_rings, &ctx->guilty);
+           if (r)
+               goto error_cleanup_entities;
+       }
    }

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).