DF-3634 — Uninitialized kernel-stack variable leaked to userspace via i915_gem_mmap_ioctl (size==0)

What

i915_gem_mmap_ioctl() (sys/dev/drm/i915/i915_gem.c:1917) declares unsigned long addr; at line 1923 and — on the DragonFly-specific fast-out for zero-length mappings — jumps past every assignment of addr:

1960 #ifdef __DragonFly__
1961         if (args->size == 0)
1962                 goto out;

The out: path then uses the uninitialized variable:

2056 out:
2057         i915_gem_object_put(obj);
2058         if (IS_ERR((void *)addr)) {          /* uninit read #1 */
2059                 DRM_DEBUG("PTR_ERR=%ld\n", PTR_ERR((void *)addr));
2060                 return addr;                 /* garbage error code */
2061         }
2063         args->addr_ptr = (uint64_t) addr;    /* uninit read #2: 8 bytes of
                                                  stale kernel stack copied to
                                                  the ioctl args */
2067         return error;                        /* error == 0 here */

The ioctl returns success and hands 8 bytes of stale kernel stack back to userspace in args->addr_ptr. The first real assignment of addr is at line 1977 (addr = round_page((vm_offset_t)p->p_vmspace->vm_taddr + maxtsiz + maxdsiz);), after the goto out.

Reachability

• Ioctl DRM_I915_GEM_MMAP is registered DRM_RENDER_ALLOW (sys/dev/drm/i915/i915_drv.c:3246) — reachable from any unprivileged user with access to a render node / card node.
• Preconditions: an open DRM fd, one GEM handle (DRM_I915_GEM_CREATE, also RENDER_ALLOW), flags=0, size=0, any valid handle.
• No DRM_AUTH, no master, no root required.
• Repeatable without limit; the leaked slot contains whatever previous kernel frames left at that stack offset (kernel pointers, user pointers, lengths). Classic KASLR-defeat / stack-content oracle.

Impact

Info leak of limited kernel memory (8 bytes of kernel stack per call, unlimited calls) → Medium per the project rubric. The secondary return addr; path can also turn garbage into an ioctl return code.

Reproduce (on hardware with an Intel GPU)

cc -O2 -Wall -o poc_df3634 poc_df3634.c
./poc_df3634 /dev/dri/card0     # or renderD128
# expected on vulnerable hw: "ioctl ret=0 addr_ptr=0x...." non-zero,
#   varying/pointing at stale stack contents across calls with
#   different preceding syscalls

On this audit guest the PoC builds cleanly but cannot execute: the QEMU guest is virtio-only (vgapci0 ... chip=0x11111234 virtio-gpu, no /dev/dri, no drm modules) and i915 is a PCI-driver that cannot attach to non-Intel hardware. Verdict is therefore inconclusive at runtime, source-certain — the uninit path is directly visible in the code and requires no race.

Fix

fix.diff in this directory (reject size==0 with -EINVAL, which also restores the intended semantics; alternative minimal fix is to initialize addr at declaration).

DF-3634 VERDICT

Status: inconclusive (runtime) / certain (source). Impact if reachable: kernel stack info leak (8 bytes/call, unlimited).

Why the bug is certain from source

1. sys/dev/drm/i915/i915_gem.c:1923 — unsigned long addr; is a plain uninitialized local.
2. sys/dev/drm/i915/i915_gem.c:1961-1962 — the DragonFly-only if (args->size == 0) goto out; bypasses the first assignment of addr at :1977 (addr = round_page((vm_offset_t)p->p_vmspace->vm_taddr + maxtsiz + maxdsiz)).
3. sys/dev/drm/i915/i915_gem.c:2056-2067 — the out: tail performs if (IS_ERR((void *)addr)) and args->addr_ptr = (uint64_t) addr; with error == 0 on this path, i.e. success + stale stack bytes copied into the ioctl out-argument.
4. Nothing between (2) and (3) assigns addr on this path (DRM_DEBUG at :1949 only prints args/obj).
5. The ioctl is unprivileged-reachable: DRM_IOCTL_DEF_DRV(I915_GEM_MMAP, i915_gem_mmap_ioctl, DRM_RENDER_ALLOW) — sys/dev/drm/i915/i915_drv.c:3246; the only precondition is a valid GEM handle, creatable via DRM_IOCTL_I915_GEM_CREATE (also RENDER_ALLOW, i915_drv.c:3243).

CWE-457 (use of uninitialized variable) / CWE-909. Comparable class: the historic DRM_INFO-leak family of uninit ioctls.

Verification performed

• PoC written with uapi structs/ioctl numbers matched 1:1 against sys/dev/drm/include/uapi/drm/i915_drm.h (DRM_I915_GEM_CREATE=0x1b, DRM_I915_GEM_MMAP=0x1e, DRM_COMMAND_BASE+nr, struct layouts verified at i915_drm.h:638 and i915_drm.h:686).
• Built on the DragonFly audit guest: BUILD-OK with cc -O2 -Wall, zero warnings (build.log).
• Execution impossible on this guest: open("/dev/dri/card0") → ENOENT; guest GPU is virtio (chip=0x11111234), no drm klds, i915 cannot probe (run.log). No Intel GPU emulation exists for this QEMU setup.
• No runtime divergence attempted via i915 module load: i915 is a PCI driver; without an Intel VGA PCI id it never attaches and creates no /dev/dri node (checked pciconf -l).

Exploit chain (on real hardware)

unprivileged open("/dev/dri/renderD128") → DRM_IOCTL_I915_GEM_CREATE (handle) → loop: interleave arbitrary syscalls (to seed the thread's kernel stack with interesting values) with DRM_IOCTL_I915_GEM_MMAP {handle, size=0} → read args->addr_ptr = 8 bytes stale kernel stack. Use for pointer disclosure / KASLR defeat; combine with any memory corruption primitive (e.g. DF-1146 in the same driver) for full compromise.

Fix validation

fix.diff authored against the read-only sys/ tree (reject size==0 with -EINVAL before the reference-counted map is attempted; also prevents the pointless object lookup/reference churn). Not applicable to build on this guest (no i915 device to test against), so fix_status=not_testable; the fix makes the uninit read unreachable by construction (early return).

Kernel references

• sys/dev/drm/i915/i915_gem.c:1923 (declaration, uninit)
• sys/dev/drm/i915/i915_gem.c:1961-1962 (DFly early-out bypassing init)
• sys/dev/drm/i915/i915_gem.c:1977 (first assignment, skipped)
• sys/dev/drm/i915/i915_gem.c:2056-2067 (uninit use → userspace leak)
• sys/dev/drm/i915/i915_drv.c:3246 (DRM_RENDER_ALLOW registration)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.