Error-cleanup NULL-deref + refcount leak in amdgpu_bo_list_create iterates wrong indices (dormant: userptr disabled on DFBSD)
Summary
amdgpu_bo_list_create error cleanup at 142-149 walks array[0..i-1] but userptr BOs placed at HIGH end (--first_userptr at 113) creating zeroed gap entries with tv.bo==NULL at [last_entry,first_userptr). Cleanup feeds NULL to ttm_to_amdgpu_bo(NULL) = container_of(NULL) = non-NULL wrapped pointer (offsetof(amdgpu_bo,tbo)>0 because preferred_domains/allowed_domains/placements precede tbo) bypasses (*bo)==NULL guard in amdgpu_bo_unref -> ttm_bo_put(NULL) -> kref_put(&NULL->kref,...) panic. Userptr BOs at high indices never visited refcount leak. DORMANT on DFBSD: amdgpu_gem_userptr_ioctl returns EINVAL (amdgpu_gem.c:289) and usertask assignment #if 0 (amdgpu_ttm.c:1364-1367) so amdgpu_ttm_tt_get_usermm always returns NULL if(usermm) branch dead code first_userptr never decrements no gap. Converts to High unpriv local DoS if userptr re-enabled. AV:L/AC:H/PR:L, A:H.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2053 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source-confirmation verdict for DF-2053 | 632 B | ↓ raw |
| fix.diff | suggested-fix | NULL-check tv.bo before container_of in bo_list_create cleanup | 579 B | view raw |
| ../fix_build.log | build-log | Batch kernel build log (all fixes, rc=0) | 5.6 MB | ↓ download |
DF-2053 Verification Verdict
Severity: Low Impact class: panic Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)
Verdict: REPRODUCED (source-confirmed)
The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.
Fix: NULL-check tv.bo before container_of in bo_list_create cleanup
Fix applied and validated in batch kernel build (rc=0, -Werror).
Fix validation
All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build.
Build result: rc=0, 0 errors (full -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): amdgpu_bo_list_create error cleanup walks array[0..i-1] but userptr BOs placed at HIGH end (--first_userptr); zeroed gap entries with tv.bo==NULL at [last_entry,first_userptr
Verified recommended fix
REPRODUCED (source-only): amdgpu_bo_list_create error cleanup walks array[0..i-1] but userptr BOs placed at HIGH end (--first_userptr); zeroed gap entries with tv.bo==NULL at [last_entry,first_userptr); cleanup feeds NULL bo to cleanup helper.
Verdict
REPRODUCED (source-only): amdgpu_bo_list_create error cleanup walks array[0..i-1] but userptr BOs placed at HIGH end (--first_userptr); zeroed gap entries with tv.bo==NULL at [last_entry,first_userptr); cleanup feeds NULL bo to cleanup helper.
No comments yet.