⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2075

drm_vm_info leaks struct_mutex permanently on SYSCTL_OUT failure (local DoS)

Summary

drm_vm_info acquires DRM_LOCK(dev) at line 175; DRM_SYSCTL_PRINT macro (122-128) on SYSCTL_OUT failure does "goto done". done: label at 203 is AFTER the only DRM_UNLOCK at 201. So SYSCTL_OUT failure inside locked region returns with lock still held. Handler returns 0 masking failure. SYSCTL_OUT ENOMEM trivially user-induced: sysctl_old_user returns ENOMEM when oldptr too small (kern_sysctl.c:1343-1344). Attacker: unprivileged local user sysctlbyname("hw.dri.0.vm",buf,&one_byte,NULL,0) -> first SYSCTL_OUT ~60 bytes into 1-byte buffer -> ENOMEM -> goto done -> lock leaked -> every subsequent DRM operation on that device deadlocks forever (console/X/VT hang). Leaf OID CTLFLAG_RD world-readable. AV:L/PR:L/AC:L, A:H. Fix: move DRM_UNLOCK to done: label.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2075 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able fix: move DRM_UNLOCK after done: label 476 B view raw
VERDICT.md verdict source-trace confirmation 776 B ↓ raw
VERDICT.md verdict source-trace confirmation
↓ download raw

DF-2075 — drm_vm_info lock leak on SYSCTL_OUT failure

Verdict

REPRODUCED (source-only confirmation). Lock leak confirmed by code inspection.

Mechanism

drm_vm_info() (sys/dev/drm/drm_sysctl.c:160) acquires DRM_LOCK(dev) at line 175. The DRM_SYSCTL_PRINT macro (122-128) performs SYSCTL_OUT and on failure does goto done. The done: label (line 203) is after the only DRM_UNLOCK(dev) at line 201. Therefore any SYSCTL_OUT failure (e.g. user-space SIGPIPE on the sysctl read) jumps past the unlock, leaking the DRM mutex — a kernel deadlock / local DoS.

Fix

Move DRM_UNLOCK(dev) to after the done: label so it always executes.

Batch-build status

Applied with all 24 other fixes; kernel + modules compiled rc=0, 0 errors, -Werror.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

Moved DRM_UNLOCK after done: label; batch build rc=0 -Werror.

Moved DRM_UNLOCK after done: label; batch build rc=0 -Werror.
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

drm_vm_info DRM_LOCK leaked on SYSCTL_OUT failure.

Verified recommended fix

drm_vm_info DRM_LOCK leaked on SYSCTL_OUT failure.

Verdict

drm_vm_info DRM_LOCK leaked on SYSCTL_OUT failure.