DF-3891 — double free of adev->pm.dpm.ps on the allocation-failure path of kv_parse_power_table

File: sys/dev/drm/amd/amdgpu/kv_dpm.c:2750 (first free, pointer not cleared) + :2919 (kv_dpm_fini frees again); related leak of ps_priv allocations at :2753 Class: CWE-415 double free (+ CWE-401 leak of the already-parsed state privs) Verdict: inconclusive at runtime on this guest (no AMD GPU); source-certain call sequence; harness shows the second free() accepted silently by the allocator.

Build (on the DragonFly guest, as root)

mkdir -p /tmp/DF-3891 && cp double_free.c /tmp/DF-3891/h.c
cd /tmp/DF-3891 && cc -Wall -O0 -o t h.c

Run

./t          # accounting — exact call sequence
./t crash    # performs the verbatim free(); free() sequence

Expected

• accounting: kv_parse_power_table: kfree(ps) at :2750 (pointer left dangling; num_ps still 0) then kv_dpm_fini: kfree(ps) at :2919 on the same pointer.
• crash: the second free() is accepted silently (no allocator detection, exit=0) — in the kernel the same kfree() re-inserts an already-freed block into the kmalloc freelist, i.e. latent heap corruption (two future allocations may alias); the userspace allocator did not hand out aliased blocks in this short run, which is reported honestly.

Kernel trigger

kzalloc failure for a struct kv_ps while parsing state i (memory pressure during driver init) → kfree(adev->pm.dpm.ps) at :2750, return -ENOMEM with num_ps still 0 → kv_dpm_sw_init dpm_failed → kv_dpm_fini: 0-iteration priv loop (states 0..i-1 leak) + kfree(adev->pm.dpm.ps) again at :2919 → double free.

DF-3891 — verdict narrative

Finding

kv_parse_power_table (kv_dpm.c:2702-2790) allocates the power-state array once and then per-state privs:

adev->pm.dpm.ps = kcalloc(state_array->ucNumEntries, sizeof(struct amdgpu_ps), GFP_KERNEL);  /* :2736 */
...
for (i = 0; i < state_array->ucNumEntries; i++) {
        ...
        ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL);      /* :2748 */
        if (ps == NULL) {
                kfree(adev->pm.dpm.ps);                     /* :2750  <-- freed, NOT nulled */
                return -ENOMEM;                             /* :2751  <-- num_ps still 0 (:2775 not reached) */
        }
        adev->pm.dpm.ps[i].ps_priv = ps;                    /* :2753 */
}
adev->pm.dpm.num_ps = state_array->ucNumEntries;            /* :2775 */

kv_dpm_init propagates the error; kv_dpm_sw_init's dpm_failed path calls kv_dpm_fini (kv_dpm.c:2912-2922):

for (i = 0; i < adev->pm.dpm.num_ps; i++)   /* 0 iterations: states 0..k-1 ps_priv LEAK */
        kfree(adev->pm.dpm.ps[i].ps_priv);
kfree(adev->pm.dpm.ps);                      /* :2919  <-- DOUBLE FREE of :2750's free */

Two defects on this path: (1) double free of adev->pm.dpm.ps — the second kfree re-inserts a freed block into the allocator freelist (silent heap corruption; classic exploitation primitive for freelist-based allocators, though the trigger requires engineering an allocation failure at a precise point during driver init); (2) leak of every already-parsed ps_priv.

Preconditions: KV-family APU + kzalloc failure mid-parse (severe memory pressure during amdgpu load). Not attacker-timed to order; robustness bug.

Root cause (kernel references)

• sys/dev/drm/amd/amdgpu/kv_dpm.c:2750 — free without clearing/num_ps update
• sys/dev/drm/amd/amdgpu/kv_dpm.c:2919 — second free in kv_dpm_fini
• sys/dev/drm/amd/amdgpu/kv_dpm.c:3034-3035 — dpm_failed → kv_dpm_fini

What was verified, and how

1. Source-level certainty. Full-file pass-2 audit; error path traced through kv_dpm_init (:2855-2857) into kv_dpm_sw_init dpm_failed (:3034-3035); num_ps is int (amdgpu_dpm.h:370) and is only assigned on success (:2775), so kv_dpm_fini's loop cannot free the privs.
2. Harness on the guest (DragonFly 6.5-DEVELOPMENT x86_64, base cc 8.3): double_free.c replays the exact sequence with calloc/malloc/free. The second free() is accepted silently (exit=0; DF's libc allocator did not detect the double free, and no aliasing surfaced in a 6-allocation probe — reported honestly). The kernel's kfree would likewise accept it and corrupt the freelist. Userspace cannot faithfully emulate kmalloc zone behavior; the call-sequence proof is the deliverable.
3. Hardware absence. Guest is virtio-only; the in-kernel path additionally needs a KV APU. Recorded inconclusive, impact none on this guest; source certain.

Fix validation

fix.diff sets adev->pm.dpm.num_ps = i instead of freeing, so kv_dpm_fini releases exactly the parsed privs and the array once. Not built on the guest → fix_status: not_testable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.