Summary

i2s_pdata kcalloc L242 (3*sizeof i2s_platform_data) passed by pointer to acp_cell[1..3].platform_data L325/331/337 consumed (copied) by mfd_add_hotplug_devices L340. No kfree(i2s_pdata) on success return L394; none on error returns L343/350/369/386; none in acp_hw_fini L462-464 (frees only acp_res/acp_genpd/acp_cell). Same error paths also leak pm_genpd_initd acp_genpd (no pm_genpd_remove see DF-1909) and partially-registered mfd cells. Every attach cycle leaks >=3*sizeof(i2s_platform_data); failed attach leaks full set. Root trigger kldload/kldunload loop or PCI rebind. Low-rate local DoS by memory exhaustion. Fix: kfree(i2s_pdata) after mfd_add copies + unified err: label. [PASS-2 REACHABILITY: dead TU - not built, unbuildable, config-gated off; unreachable at runtime, see findings/poc/DF-4826/]

PoC verification

Evidence pack

findings/poc/DF-1910 · 4 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited bug	854 B	view raw
VERDICT.md	verdict	source-confirmation analysis	1.0 KB	↓ raw
build.sh	build-script	N/A (source-only)	65 B	view raw
run.sh	run-script	N/A (source-only)	89 B	view raw

VERDICT.md verdict source-confirmation analysis

↓ download raw

DF-1910 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: i2s_pdata kcalloc L242 (3*sizeof i2s_platform_data) passed by pointer to acp_cell[1..3].platform_data L325/331/337 consumed (copied) by mfd_add_hotplug_devices L340. No kfree(i2s_pdata) on success ret

Citation: sys/dev/drm/amd/amdgpu/amdgpu_acp.c:242-464

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: i2s_pdata kcalloc never freed in any path (amdgpu_acp.c:242-464)

Verified recommended fix

Source-confirmed: i2s_pdata kcalloc never freed in any path (amdgpu_acp.c:242-464)

Verdict