• File: sys/dev/drm/amd/amdgpu/amdgpu_fb.c
• Lines: 213, 219–220, 225, 146, 248
• Severity: Low
• CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U:C:L/I:N/A:N
• CWE: CWE-457 Use of Uninitialized Variable
• Confidence: certain
• Status: new
• Related: DF-1971 (radeon_fb.c identical-class bug)

Summary

The stack-allocated struct drm_mode_fb_cmd2 mode_cmd; at line 213 is only partially initialized. The remaining fields — pitches[1..3], offsets[0..3], modifier[0..3], flags, handles[0..3], fb_id — contain uninitialized stack garbage. These are copied verbatim into the long-lived drm_framebuffer by drm_helper_mode_fill_fb_struct (amdgpu_display.c:513 → drm_modeset_helper.c:88-92) and persist for the framebuffer's lifetime.

Root cause

Line 213: struct drm_mode_fb_cmd2 mode_cmd; — stack-allocated, no initializer.

Explicitly set fields: - mode_cmd.width = sizes->surface_width (line 219) - mode_cmd.height = sizes->surface_height (line 220) - mode_cmd.pixel_format = drm_mode_legacy_fb_format(...) (line 225-226) - mode_cmd.pitches[0] = amdgpu_align_pitch(...) (line 146, inside create_pinned_object)

Uninitialized fields (stack garbage): - mode_cmd.pitches[1], pitches[2], pitches[3] - mode_cmd.offsets[0], offsets[1], offsets[2], offsets[3] - mode_cmd.modifier[0], modifier[1], modifier[2], modifier[3] - mode_cmd.flags - mode_cmd.handles[0], handles[1], handles[2], handles[3] - mode_cmd.fb_id

These are passed to amdgpu_display_framebuffer_init() (line 248-249) → drm_helper_mode_fill_fb_struct() (amdgpu_display.c:513). That function copies them directly into the drm_framebuffer (drm_modeset_helper.c:87-92):

for (i = 0; i < 4; i++) {
    fb->pitches[i] = mode_cmd->pitches[i];   // copies garbage for i=1,2,3
    fb->offsets[i] = mode_cmd->offsets[i];   // copies garbage for all i
}
fb->modifier = mode_cmd->modifier[0];          // copies garbage
fb->flags = mode_cmd->flags;                   // copies garbage

The fbdev framebuffer is long-lived (persists until driver unload).

Threat model

Minimal practical impact for the fbdev framebuffer (single-plane XRGB8888, so pitches[1..3] and offsets[] are unused). The info leak is of kernel stack contents into the drm_framebuffer's pitches/offsets/modifier fields, which could be read back via DRM_IOCTL_MODE_GETFB2 by a DRM client.

The leaked bytes are stack garbage (not secrets in practice, but theoretically could contain prior function call residuals).

Severity is Low because the fbdev framebuffer is kernel-internal and not directly exposed to user-mode ADDFB2-style queries.

Proof of concept

1. Load amdgpu driver with a display connected (triggers amdgpufb_create).
2. Open the DRM device.
3. Use DRM_IOCTL_MODE_GETFB (or GETFB2) on the fbdev framebuffer ID (obtained via DRM_IOCTL_MODE_GETRESOURCES).
4. The returned pitches[1..3], offsets[0..3], modifier values contain whatever was on the kernel stack at the time amdgpufb_create ran — typically zeros from kzalloc'd stack pages, but could contain residual data from prior kernel function calls.
5. Success: non-zero values in secondary plane pitches/offsets that were never explicitly set.

Note: on DragonFly, DRM_IOCTL_MODE_GETFB may not be fully wired, limiting exposure.

Recommended fix

Zero-initialize mode_cmd before use:

--- a/sys/dev/drm/amd/amdgpu/amdgpu_fb.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_fb.c
@@ -213,6 +213,7 @@ static int amdgpufb_create(struct drm_fb_helper *helper,
    struct drm_mode_fb_cmd2 mode_cmd;
    struct drm_gem_object *gobj = NULL;
    struct amdgpu_bo *abo = NULL;
+   memset(&mode_cmd, 0, sizeof(mode_cmd));
    int ret;

References

• sys/dev/drm/amd/amdgpu/amdgpu_fb.c:213 — uninitialized stack mode_cmd
• sys/dev/drm/amd/amdgpu/amdgpu_fb.c:219-225,146 — partial initialization
• sys/dev/drm/amd/amdgpu/amdgpu_display.c:513 — drm_helper_mode_fill_fb_struct called
• sys/dev/drm/drm_modeset_helper.c:87-92 — copies all fields verbatim into long-lived fb