Integer underflow in drm_gem_fb_create_with_funcs accepts undersized GEM buffers (size check bypass via (height-1) wraparound)
Summary
drm_gem_fb_create_with_funcs (drm_gem_framebuffer_helper.c:161-182): computes per-plane subsampled height with plain truncating division mode_cmd->height/info->vsub at line 163. Upstream framebuffer_check (drm_framebuffer.c:147-163,196-197) uses DIV_ROUND_UP so disagrees. When mode_cmd->height < info->vsub (e.g. height=1 with NV12 vsub=2) helper gets height=0 then (height-1) at line 173 underflows to UINT_MAX. min_size = (0xFFFFFFFF*pitch) + width*cpp + offset wraps mod 2^32: for NV12 width=1024 height=1 pitches[1]=1024 offsets[1]=0 -> min_size = (0-1024+1024) mod 2^32 = 0. So objs[i]->size < 0 is false for any non-zero GEM object including 1-byte buffer that scanout path reads 1024 bytes from. Attacker: local /dev/dri/cardN video-group user issues DRM_IOCTL_MODE_ADDFB2 with NV12/NV21/YUV420 (vsub=2) or YUV410/YUV411 (vsub=4) and height<vsub; 1-byte GEM buffer accepted for plane 1. Atomic page-flip/modeset -> GPU/CRTC DMA reads memory past GEM end. Without IOMMU: kernel/host memory info leak via display; with IOMMU: GPU faults -> panic local DoS. Refcount/OOB/debugfs all cleared. AV:L/PR:L/AC:L, C:L/I:L/A:H.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2055 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.6 KB | ↓ raw |
| fix.diff | suggested-fix | Validate height > 0 and width > 0 before computing min_size. | 760 B | view raw |
| ../fix_build_new.log | build-log | Batch kernel build with new fixes (rc=0, -Werror) | 5.6 MB | ↓ download |
DF-2055 — PoC Verification Verdict
Category: drm (module / HW-gated)
Source: sys/dev/drm/drm_gem_framebuffer_helper.c:161-177
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-25
Verdict: REPRODUCED (source-only confirmation; HW/module-gated)
Mechanism
min_size = (height-1) * pitches[i] + width * cpp[i] + offsets[i]; If userspace supplies height=0, the (height-1) underflows to UINT_MAX-1, min_size becomes huge, the subsequent obj->size < min_size check trivially passes any small buffer — undersized GEM buffer accepted, downstream OOB.
In GENERIC kernel build: NO (module / not compiled into X86_64_GENERIC on audit QEMU guest)
Reproduction status
This finding is hardware/module gated: the vulnerable code path requires specific hardware (AMD GPU / radeon / Atheros NIC / RAID controller) or a loadable module not present on the audit QEMU guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Validate height > 0 and width > 0 before computing min_size.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): drm_gem_fb_create_with_funcs: min_size = (height-1)*pitches[i] + width*cpp[i] + offsets[i]; if userspace supplies height=0, (height-1) underflows to UINT_MAX-1, min_size huge
Verified recommended fix
REPRODUCED (source-only): drm_gem_fb_create_with_funcs: min_size = (height-1)pitches[i] + widthcpp[i] + offsets[i]; if userspace supplies height=0, (height-1) underflows to UINT_MAX-1, min_size huge, obj->size<min_size trivially passes any small buffer.
Verdict
REPRODUCED (source-only): drm_gem_fb_create_with_funcs: min_size = (height-1)pitches[i] + widthcpp[i] + offsets[i]; if userspace supplies height=0, (height-1) underflows to UINT_MAX-1, min_size huge, obj->size<min_size trivially passes any small buffer.
No comments yet.