• File: sys/dev/drm/amd/amdgpu/amdgpu_fb.c
• Lines: 255, 316
• Severity: Low
• CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U:C:N/I:N/A:H
• CWE: CWE-763 Release of Invalid Pointer or Pointer to Inconsistent Data
• Confidence: certain
• Status: new
• Related: DF-1970 (radeon_fb.c identical-class bug)

Summary

The error path at line 316 does kfree(fb) where fb = &rfbdev->rfb.base (line 255) is an embedded struct inside the kzalloc'd amdgpu_fbdev, not a separately allocated object. Calling kfree on an interior pointer corrupts the kernel heap.

On DragonFly this path is currently unreachable with non-NULL fb (no goto out after line 255), but the #else (Linux) path at line 293-296 does have a goto out reachable with fb set, making this a live bug on non-DF builds and a dangerous landmine on DF.

Root cause

At line 255: fb = &rfbdev->rfb.base. The amdgpu_fbdev struct (amdgpu_mode.h:316-321) embeds struct amdgpu_framebuffer rfb (line 318), which in turn embeds struct drm_framebuffer base (amdgpu_mode.h:310).

So fb points to an interior offset of the kzalloc'd rfbdev allocation (line 360 of amdgpu_fbdev_init).

The error path at line 312-317 does:

drm_framebuffer_cleanup(fb);  // removes fb from DRM lists
kfree(fb);                    // frees from the WRONG offset

kfree() expects a pointer to the start of a slab/kmalloc allocation. Passing an interior pointer (rfbdev->rfb.base, which is at a non-zero offset within rfbdev) corrupts the slab allocator's metadata, leading to heap corruption, double-free, or panic.

On DragonFly

The #ifdef __DragonFly__ block (lines 260-270) has no goto out after fb is set at line 255 — it falls through to return 0 at line 306. So kfree(fb) is unreachable with non-NULL fb on DF.

On Linux (the #else path, lines 271-297)

Line 293-296 has if (info->screen_base == NULL) { ret = -ENOSPC; goto out; } which IS reachable with fb non-NULL. On Linux builds, this would be a live heap corruption bug.

This code was clearly copied from a context where fb was separately kzalloc'd (like amdgpu_display_user_framebuffer_create at amdgpu_display.c:544 kzallocs amdgpu_fb) without adapting for the embedded case. The radeon_fb.c equivalent (lines 327-332) has the identical bug.

Threat model

On DragonFly: latent — any future code change that adds a goto out after line 255 (e.g., a new error check in the DragonFly info-setup block) would instantly make this a heap corruption primitive.

On Linux: live heap corruption when amdgpu_bo_kptr() returns NULL (line 282/293), which can happen under memory pressure or on specific ASICs.

Impact: kernel heap corruption → potential code execution in ring 0, or immediate panic.

Proof of concept

On DragonFly: not directly triggerable (the goto out at line 295 is in the #else block). The risk is that a maintainer adds an error check in the #ifdef __DragonFly__ block (e.g., checking for NULL vaddr) and the existing kfree(fb) becomes a heap corruption.

On Linux: trigger amdgpu_bo_kptr returning NULL by consuming system memory before fbdev init, then kfree on the interior pointer corrupts the slab.

PoC sketch for the latent DF risk: apply a trivial one-line patch adding if (!info->vaddr) { ret = -ENOMEM; goto out; } after line 270, then boot with an amdgpu card — the first modeset triggers kfree on the embedded fb → immediate panic.

Recommended fix

Remove the kfree(fb) entirely — fb is never separately allocated in this function. The fix is included in the diff for DF-1982, which replaces the entire error block with just if (gobj) amdgpufb_destroy_pinned_object(gobj);.

The framebuffer cleanup (drm_framebuffer_unregister_private / drm_framebuffer_cleanup) is handled later by amdgpu_fbdev_destroy() when obj[0] is set, or is unnecessary when obj[0] is NULL (framebuffer_init failed).

References

• sys/dev/drm/amd/amdgpu/amdgpu_fb.c:255 — fb = &rfbdev->rfb.base
• sys/dev/drm/amd/amdgpu/amdgpu_fb.c:316 — the latent kfree(fb)
• sys/dev/drm/amd/amdgpu/amdgpu_mode.h:310,316-321 — fb is embedded inside rfbdev
• sys/dev/drm/amd/amdgpu/amdgpu_display.c:544 — different code path where kzalloc(amdgpu_fb) makes kfree valid