• File: sys/dev/drm/radeon/radeon_fb.c
• Lines: 240–333 (error label at 322–333)
• Severity: Low
• CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• CWE: CWE-401 Missing Release of Memory after Effective Lifetime
• Confidence: certain
• Status: new

Summary

When drm_fb_helper_alloc_fbi() (radeon_fb.c:249) or radeon_framebuffer_init() (radeon_fb.c:257) fails after radeonfb_create_pinned_object() has succeeded, the created-and-pinned GEM object gobj is never released. The error label out: contains a dead if (rbo) { } empty block where the cleanup was evidently intended, and the only drm_gem_object_put_unlocked(gobj) on this path (radeon_fb.c:328) is gated by if (fb && ret) — but fb = &rfbdev->fb is not assigned until line 263, i.e. only after init has already succeeded.

Root cause

Flow at radeon_fb.c:240-263: radeonfb_create_pinned_object(rfbdev, &mode_cmd, &gobj) creates a VRAM-pinned, kmap'd GEM object with refcount 1 held by gobj (radeon_fb.c:156-158 → radeon_gem_object_create at radeon_gem.c:47-94).

At radeon_fb.c:249 drm_fb_helper_alloc_fbi may fail (PTR_ERR → goto out at line 252); at radeon_fb.c:257 radeon_framebuffer_init may fail (goto out at line 260).

On either branch fb (declared = NULL at radeon_fb.c:223) is still NULL because the assignment fb = &rfbdev->fb; is at line 263, AFTER the init call.

The cleanup label (radeon_fb.c:323-333) has if (rbo) { } with empty body (no unref), and if (fb && ret) is therefore false on both real error paths, so drm_gem_object_put_unlocked(gobj) at radeon_fb.c:328 never executes.

radeon_framebuffer_init's own failure path sets rfbdev->fb.obj[0] = NULL (radeon_display.c:1305), so radeon_fbdev_destroy() (called later via the fini path) sees obj[0]==NULL and also skips cleanup.

Net: the GEM object's refcount is never decremented; it and its pinned VRAM reservation are leaked permanently. Triggerable on every fb_probe retry under memory pressure or repeated hotplug events.

Threat model

Attacker position: local user with privileges to trigger connector hotplug/reprobe cycles (any user with access to the DRM device, or external hotplug via USB-C/DP).

Trigger: repeat the failed fb_probe path to leak one pinned VRAM GEM object per attempt, exhausting video memory and eventually preventing legitimate framebuffer allocation (local DoS of the graphics subsystem).

Impact: pure resource exhaustion, bounded by VRAM size. No memory-corruption or info-leak impact.

Proof of concept

fb_probe failures are most easily induced by saturating VRAM (allocate large GEM objects via the radeon gem_create ioctl until near exhaustion) so that radeon_gem_object_create inside the next fb_probe (radeon_fb.c:156) fails. Then force a connector reprobe — on DragonFly, toggling the DPMS state via vidcontrol -c on /dev/ttyv0 or unplugging/replugging a monitor, or running xrandr --query against /dev/dri/card0 in a tight loop, will schedule drm_fb_helper_hotplug_event. Each cycle that hits the error path leaks the rbo.

Verify with kldstat -v radeon counters / vmstat -m radeon_bo entries growing without bound.

Success criterion: VRAM exhaustion, fbcon stops updating.

Recommended fix

Add the missing unref on the error path. This also neutralises the latent kfree()-on-embedded-struct bug at radeon_fb.c:331 (DF-1970).

--- a/sys/dev/drm/radeon/radeon_fb.c
+++ b/sys/dev/drm/radeon/radeon_fb.c
@@ -321,14 +321,13 @@ static int radeonfb_create(struct drm_fb_helper *helper,
    vga_switcheroo_client_fb_set(rdev->ddev->pdev, info);
    return 0;

 out:
-   if (rbo) {
-
-   }
+   if (rbo)
+       drm_gem_object_put_unlocked(gobj);
    if (fb && ret) {
        drm_gem_object_put_unlocked(gobj);
        drm_framebuffer_unregister_private(fb);
        drm_framebuffer_cleanup(fb);
-       kfree(fb);
+       /* fb is &rfbdev->fb (embedded) — must not kfree */
    }
    return ret;

References

• sys/dev/drm/radeon/radeon_fb.c:240-263 — the error-prone init sequence
• sys/dev/drm/radeon/radeon_fb.c:322-333 — the dead if (rbo) {} block
• sys/dev/drm/radeon/radeon_gem.c:47-94 — radeon_gem_object_create refcount contract
• sys/dev/drm/radeon/radeon_display.c:1305 — radeon_framebuffer_init failure path