DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2208

Missing NULL checks on kzalloc/kasprintf returns in drm_sysfs_connector_add cause NULL-deref panic under OOM

Summary

drm_sysfs_connector_add() calls kzalloc() at line 39 and immediately dereferences result at line 40 without NULL check. If kzalloc fails under OOM connector->kdev is NULL and write to connector->kdev->kobj.name at line 40 triggers kernel page fault/panic. Same line also calls kasprintf() whose return assigned to kobj.name without NULL check -- if kasprintf fails kobj.name is NULL any later dereference (intel_dp.c:5251 connector->kdev->kobj.name) panics. Function unconditionally returns 0 so callers cannot detect failure. Contrast drm_sysfs_minor_alloc() at 93-95 correctly checks kzalloc and returns ERR_PTR(-ENOMEM). Trigger: unprivileged local user induces kernel memory pressure during DRM connector registration window (GPU hotplug DP MST topology change driver reload kldload/kldunload or initial driver attach at boot). Deref is write to fixed offset within struct device faulting at low virtual address panic not controllable corruption.

Discussion (0)

No comments yet.