Memory leak of userspace entry array on idr_alloc failure in BO_LIST_OP_CREATE
Summary
amdgpu_bo_list_ioctl CREATE path: info allocated via amdgpu_bo_create_list_entry_array (271 kvmalloc bo_number*8 bytes). After amdgpu_bo_list_create succeeds (277) idr_alloc fails (283 r<0): lines 285-287 do "amdgpu_bo_list_put(list); return r;" -- bare return bypasses error_free label never kvfree(info). Structurally identical UPDATE path at 308-312 correctly uses goto error_free. Each occurrence leaks bo_number*sizeof(drm_amdgpu_bo_list_entry)=bo_number*8 bytes M_DRM. Attacker: unpriv render client (DRM_AUTH|DRM_RENDER_ALLOW amdgpu_kms.c:1201). Precondition: idr_alloc ENOMEM (memory pressure). AV:L/AC:H/PR:L, A:L.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2054 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source-confirmation verdict for DF-2054 | 636 B | ↓ raw |
| fix.diff | suggested-fix | Fix error path to goto error_free to free info on idr_alloc failure | 579 B | view raw |
| ../fix_build.log | build-log | Batch kernel build log (all fixes, rc=0) | 5.6 MB | ↓ download |
DF-2054 Verification Verdict
Severity: Low Impact class: leak Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)
Verdict: REPRODUCED (source-confirmed)
The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.
Fix: Fix error path to goto error_free to free info on idr_alloc failure
Fix applied and validated in batch kernel build (rc=0, -Werror).
Fix validation
All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build.
Build result: rc=0, 0 errors (full -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): amdgpu_bo_list_ioctl CREATE path: info allocated via amdgpu_bo_create_list_entry_array; after amdgpu_bo_list_create succeeds, idr_alloc failure path leaks info (goto err_free
Verified recommended fix
REPRODUCED (source-only): amdgpu_bo_list_ioctl CREATE path: info allocated via amdgpu_bo_create_list_entry_array; after amdgpu_bo_list_create succeeds, idr_alloc failure path leaks info (goto err_free checks wrong branch).
Verdict
REPRODUCED (source-only): amdgpu_bo_list_ioctl CREATE path: info allocated via amdgpu_bo_create_list_entry_array; after amdgpu_bo_list_create succeeds, idr_alloc failure path leaks info (goto err_free checks wrong branch).
No comments yet.