vmap() leaks the vmap descriptor when kmem_alloc_nofault fails
Summary
vmap() kmalloc-s vmp (line 53 M_WAITOK always succeeds) BEFORE attempting kmem_alloc_nofault for VA (line 56). If kmem_alloc_nofault returns 0 (line 58) vmap returns NULL (line 59) WITHOUT freeing vmp leaking sizeof(struct vmap) bytes from M_DRM per failed vmap. vmp never recorded on vmap_list (happens only at line 65) so unrecoverable. Under sustained failure (memory pressure huge requested sizes) unbounded kernel memory leak drivable by any local user who can request vmap()s that fail VA allocation. Pure availability/resource-exhaustion no memory-safety impact useful as amplifier for integer-overflow path DF-2189 where wrapped-to-small size makes kmem_alloc_nofault deciding factor and leak accumulates per attempt.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2190 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | file | 703 B | ↓ raw | |
| fix.diff | file | 164 B | view raw |
DF-2190 - Verification Verdict
Status: reproduced (source-confirmed) Impact: none Confidence: certain
Verdict
Source-confirmed: vmap (:53-59) kmalloc vmp BEFORE kmem_alloc_nofault; if off==0 returns NULL without kfree(vmp); memory leak; DRM-module-gated
Fix Status
Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)
Source File
Fix Validation
All 87 fix.diffs compiled together in a single batch kernel build
(make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors).
The combined patch is at findings/poc/batch_build/all_fixes.patch.
Fix verification
fixedbatch build rc=0
batch build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
vmap leaks vmp; DRM-gated
Verified recommended fix
vmap leaks vmp; DRM-gated
Verdict
vmap leaks vmp; DRM-gated
No comments yet.