Summary

dma_buf_export() allocates struct dma_buf via kmalloc(sizeof(struct dma_buf), M_DRM, M_WAITOK) without M_ZERO, then sets priv/ops/size/file but never assigns dmabuf->resv — even though exp_info->resv is populated by callers (drm_prime.c:548-549). The resv field retains whatever slab garbage was left by a prior M_DRM allocation. Multiple GPU drivers (amdgpu_prime.c:164, radeon_prime.c:77, i915_gem_dmabuf.c:322, drm_gem_framebuffer_helper.c:262) subsequently read dma_buf->resv and dereference it (ww_mutex_lock(&resv->lock) / reservation_object_get_excl_rcu(resv)), causing a kernel panic or, with slab grooming, an arbitrary pointer dereference.

Root cause

linux_dma-buf.c:127:

dmabuf = kmalloc(sizeof(struct dma_buf), M_DRM, M_WAITOK);

M_WAITOK does NOT imply M_ZERO (M_WAITOK=0x0002, M_ZERO=0x0100). Lines 131-134 set priv, ops, size, file — but resv is never assigned.

Confirmed consumers that dereference the uninitialized resv: - amdgpu_prime.c:164: resv = attach->dmabuf->resv; → ww_mutex_lock(&resv->lock, NULL) (line 177) - radeon_prime.c:77: identical pattern - i915_gem_dmabuf.c:322: obj->resv = dma_buf->resv; (TTM derefs extensively later) - drm_gem_framebuffer_helper.c:262: reservation_object_get_excl_rcu(dma_buf->resv)

Threat model & preconditions

• Attacker position: any local user with DRM render-node access who triggers cross-driver or same-driver PRIME import.
• Privileges gained or impact: kernel panic from dereferencing a random slab-resident pointer (DoS). If the attacker can groom the M_DRM slab to place a controlled pointer at the resv offset (via prior DRM object alloc/free cycles), this becomes an arbitrary kernel read/write primitive.
• Required config or capabilities: DRIVER_PRIME set by i915, amdgpu, or radeon.
• Reachability: DRM_IOCTL_PRIME_FD_TO_HANDLE on a dma-buf fd.

Recommended fix

Copy exp_info->resv into dmabuf->resv during initialization. Also M_ZERO the allocation as defense-in-depth.

--- a/sys/dev/drm/linux_dma-buf.c
+++ b/sys/dev/drm/linux_dma-buf.c
@@ -124,11 +124,13 @@ dma_buf_export(const struct dma_buf_export_info *exp_info)
    if (fp == NULL)
        return ERR_PTR(-ENFILE);

-   dmabuf = kmalloc(sizeof(struct dma_buf), M_DRM, M_WAITOK);
+   dmabuf = kmalloc(sizeof(struct dma_buf), M_DRM, M_WAITOK | M_ZERO);
    fp->f_type = DTYPE_DMABUF;
    fp->f_ops = &dmabuf_fileops;
    fp->private_data = dmabuf;
    dmabuf->priv = exp_info->priv;
    dmabuf->ops = exp_info->ops;
+   dmabuf->resv = exp_info->resv;
    dmabuf->size = exp_info->size;
    dmabuf->file = fp;

Timeline

• 2026-07-25 Discovered during automated audit.
• 2026-07-25 Reported to DragonFlyBSD security contact.