drm_bufs_info NULL-pointer write when M_NULLOK kmalloc fails (local panic)
Summary
drm_bufs_info kmalloc(sizeof(int)*dma->buf_count,M_DRM,M_WAITOK|M_NULLOK) at 226-227. M_NULLOK permits return NULL (kern_objcache.c:547 only retries when (M_WAITOK|M_NULLOK)==M_WAITOK i.e. M_NULLOK absent). NO NULL check before loop 228-229 templists[i]=dma->buflist[i]->list writes through NULL base -> immediate panic. Sibling drm_clients_info at 274-279 correctly checks if(tempprivs==NULL){DRM_UNLOCK;return ENOMEM}. Under memory pressure (mlock/memset bomb) unprivileged user triggers hw.dri.0.bufs read -> NULL -> write to (NULL+i*4) -> page fault -> panic. Requires legacy DMA driver (dev->dma!=NULL; radeon/pre-KMS intel). Under DRM_LOCK so also leaves struct_mutex unreleased. AV:L/AC:H/PR:L, A:H. Fix: add NULL check mirroring drm_clients_info.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2076 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix | 476 B | view raw |
| VERDICT.md | verdict | source-trace confirmation | 668 B | ↓ raw |
DF-2076 — drm_bufs_info missing NULL check on M_NULLOK kmalloc
Verdict
REPRODUCED (source-only confirmation). Bug confirmed by source tracing.
Mechanism
drm_bufs_info() (drm_sysctl.c:226-227) calls kmalloc with M_WAITOK|M_NULLOK which permits NULL return. The loop at 228-229 immediately dereferences templists[i] without a NULL check. The sibling drm_clients_info() at 274-279 demonstrates the correct pattern (check + ENOMEM return).
Fix
Add NULL check after kmalloc matching drm_clients_info pattern: if NULL, DRM_UNLOCK + return ENOMEM.
Batch-build status
Applied with all 24 other fixes; kernel + modules compiled rc=0, 0 errors, -Werror.
Fix verification
fixedAdded NULL check; batch build rc=0 -Werror.
Added NULL check; batch build rc=0 -Werror.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
drm_bufs_info kmalloc M_NULLOK NULL not checked.
Verified recommended fix
drm_bufs_info kmalloc M_NULLOK NULL not checked.
Verdict
drm_bufs_info kmalloc M_NULLOK NULL not checked.
No comments yet.