DF-3864 — amdgpu_vm_init() error paths dereference vm->root.base.bo before it is assigned (NULL deref → kernel panic)

File: sys/dev/drm/amd/amdgpu/amdgpu_vm.c — amdgpu_vm_init() (3048-3148)

Root cause

vm->root.base.bo is only published by amdgpu_vm_bo_base_init() at amdgpu_vm.c:3107 — i.e. AFTER amdgpu_bo_reserve() (3097) and amdgpu_vm_clear_bo() (3101) succeed. But the error labels assume it is already set:

    r = amdgpu_bo_reserve(root, true);
    if (r)
        goto error_free_root;           /* 3097-3099: base.bo == NULL */

    r = amdgpu_vm_clear_bo(adev, vm, root, ...);
    if (r)
        goto error_unreserve;           /* 3101-3105: base.bo == NULL */

    amdgpu_vm_bo_base_init(&vm->root.base, vm, root);   /* 3107 */
    ...
error_unreserve:
    amdgpu_bo_unreserve(vm->root.base.bo);  /* 3137: ttm_bo_unreserve(&NULL->tbo) */
error_free_root:
    amdgpu_bo_unref(&vm->root.base.bo->shadow); /* 3140: &NULL->shadow */
    amdgpu_bo_unref(&vm->root.base.bo);

• clear_bo failure → amdgpu_bo_unreserve(NULL) → ttm_bo_unreserve(&NULL->tbo) (amdgpu_object.h:165-168) → lock/atomic ops at a near-NULL address → panic.
• reserve failure → amdgpu_bo_unref(&vm->root.base.bo->shadow) → &NULL->shadow = small constant → *bo load at low address → panic.

Reachability

amdgpu_vm_init() runs on EVERY DRM device open (amdgpu_kms.c:990, amdgpu_driver_open_kms). amdgpu_vm_clear_bo() allocates an IB from the shared, bounded IB pool (amdgpu_ib.c:279-287, AMDGPU_IB_POOL_SIZE*64*1024) and does TTM validation — both fail under memory/IB pressure, which an unprivileged render-node user can induce with concurrent context creation + IB consumers. Unprivileged local DoS (kernel panic) on amdgpu hardware.

The same defect exists in upstream Linux ~4.20 (verified against v4.20 sources — same labels, same ordering).

Trigger

vm_init_error_race.c — hammers the render node with concurrent open()/close() (each open runs amdgpu_vm_init) while an IB-pool consumer runs, forcing amdgpu_job_alloc_with_ib inside clear_bo to fail on some open. On hardware with a DEBUG kernel the panic backtrace lands in amdgpu_bo_unreserve/ttm_bo_unreserve called from amdgpu_vm_init.

Fix

fix.diff uses the local root pointer on both error labels (the variable that IS valid on every path reaching them).

DF-3864 VERDICT — not_reproduced at runtime (hardware-gated); NULL-deref certain at source

Runtime

Guest has no AMD GPU: no /dev/dri node exists, amdgpu_driver_open_kms() / amdgpu_vm_init() never execute. The trigger binary was compiled and run on the guest: it exits reporting No such file or directory on /dev/dri/renderD128 (see run.log). status = not_reproduced, reproduced = 0, runtime impact none — source-level impact is an unprivileged local kernel panic (DoS) on amdgpu hardware, Medium.

Source proof (no hardware needed)

Order of operations in amdgpu_vm_init (amdgpu_vm.c): - 3093 amdgpu_bo_create(adev, &bp, &root) — local root only. - 3097 amdgpu_bo_reserve(root, true); on failure → 3098 goto error_free_root — at this point vm->root.base.bo is still NULL (caller kzalloc'd fpriv; base_init has not run). - 3101 amdgpu_vm_clear_bo(...); on failure → 3104 goto error_unreserve → 3136-3137 amdgpu_bo_unreserve(vm->root.base.bo); = amdgpu_bo_unreserve(NULL) → ttm_bo_unreserve(&bo->tbo) with bo == NULL (amdgpu_object.h:165-168) → near-NULL address lock manipulation → page fault/panic. - error_free_root: 3139-3140 amdgpu_bo_unref(&vm->root.base.bo->shadow); — computing &vm->root.base.bo->shadow with base.bo == NULL yields the small constant offsetof(amdgpu_bo, shadow); amdgpu_bo_unref then loads *bo from that low address (amdgpu_object.c:817-825) → page fault/panic.

amdgpu_vm_clear_bo() failure is a normal errno path: it calls amdgpu_job_alloc_with_ib (amdgpu_vm.c:855) which draws from the global bounded IB pool (amdgpu_ib.c:279-287), plus ttm_bo_validate and amdgpu_ttm_alloc_gart — all exhaustible under load by unprivileged render-node users.

Call site: amdgpu_kms.c:990 — every open("/dev/dri/renderD128") by an unprivileged user.

Upstream v4.20 carries the identical code (verified from upstream source); still a live defect in this tree.

Fix validation

fix.diff replaces both error-label derefs with the local root pointer; git apply --check clean. Not exercisable on this guest: fix_status = not_testable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.