DF-3973 — btc_dpm_init failure ignored: dangling rdev->pm.dpm.ps double-free in btc_dpm_fini (+ r600_free_extended_power_table double free, ps_priv/eg_pi leaks)

• File: sys/dev/drm/radeon/btc_dpm.c (pass 2), cross-file sinks rv770_dpm.c / r600_dpm.c / radeon_pm.c
• Class: CWE-416 use-after-free / double free (Medium)
• Family: DF-3645 (ci) / DF-3755 (ni) / DF-3955 (kv) — the btc twin, checklist item (b).

Build / Run / Expected

Hardware-gated (Barts/Turks/Caicos). Trigger requires a memory-allocation failure at a specific kzalloc during VBIOS power-table parse, achievable under kernel heap pressure (spray kmalloc-64/128 until allocation fails at the right site). No PoC without the card.

Root cause (source-level)

1. rv7xx_parse_power_table() — sys/dev/drm/radeon/rv770_dpm.c:2289-2329: - allocates rdev->pm.dpm.ps (2289); - on per-state ps_priv kzalloc failure (2306-2310) it does kfree(rdev->pm.dpm.ps); return -ENOMEM; without NULLing the pointer and leaks all previously allocated ps_priv objects. num_ps is only set at 2327, so it stays 0 while dpm.ps dangles.
2. btc_dpm_init() — sys/dev/drm/radeon/btc_dpm.c:2574-2576 — propagates the error.
3. radeon_pm_init_dpm() — sys/dev/drm/radeon/radeon_pm.c:1448 — ignores radeon_dpm_init()'s return and continues to radeon_dpm_setup_asic/radeon_dpm_enable. boot_ps may already point at the freed array (if a BOOT state was parsed before the failing state) → UAF read during enable.
4. On driver teardown, radeon_pm_fini_dpm() → radeon_dpm_fini() (radeon_pm.c:1705, unconditional) → btc_dpm_fini() — btc_dpm.c:2721-2724: - for (i = 0; i < num_ps; i++) kfree(ps[i].ps_priv); (0 iterations, num_ps==0) - kfree(rdev->pm.dpm.ps); — double free of the array freed at rv770_dpm.c:2308. If the slab object was reused in between, this frees a live foreign object.
5. Second error path: btc_dpm_init at 2583-2586, when the vddc_dependency_on_dispclk.entries kzalloc fails, calls r600_free_extended_power_table(rdev) and returns; r600_free_extended_power_table (r600_dpm.c:1299-1315) kfrees 13 dyn_state pointers without NULLing any of them. Teardown then calls it again from btc_dpm_fini (2727) → double free of every allocated extended-power-table object. eg_pi also leaks on every early error return (2559 sets priv; no free on 2570-2586).

Expected manifestation

Heap corruption (double free) at driver unload/detach, or UAF reads during the ignored-error enable run. Same class and reachability as DF-3755 (rated Medium, C:H/I:H/A:H).

VERDICT — DF-3973

status: inconclusive (hardware-gated; source-level certainty: likely — requires an alloc failure at the exact kzalloc site, which is attacker-influenceable via heap pressure but probabilistic)

Trace (proof of the code shape)

Path A — dangling ps array: - rv770_dpm.c:2289 rdev->pm.dpm.ps = kzalloc(...) - rv770_dpm.c:2306-2310 per-state ps = kzalloc(sizeof(struct rv7xx_ps)); on failure: kfree(rdev->pm.dpm.ps); return -ENOMEM; — pointer left dangling, earlier ps_priv leaked, num_ps (2327) never assigned → remains 0. - btc_dpm.c:2574-2576 ret = rv7xx_parse_power_table(rdev); if (ret) return ret; - radeon_pm.c:1448 radeon_dpm_init(rdev); — return value discarded; 1452-1453 setup+enable run regardless. If a BOOT-classified state was parsed before the failure, boot_ps points INTO the freed array (UAF reads through btc_init_smc_table at btc_dpm.c:2446); if not, boot_ps is NULL → DF-3972's panic instead. - radeon_pm.c:1705 radeon_dpm_fini unconditional at teardown → btc_dpm.c:2724 kfree(rdev->pm.dpm.ps) → second free of the same object (num_ps==0 so the ps_priv loop is skipped).

Path B — extended-power-table double free: - btc_dpm.c:2581-2586: vddc_dependency_on_dispclk.entries kzalloc failure → r600_free_extended_power_table(rdev); return -ENOMEM; - r600_dpm.c:1299-1315: 13 kfree()s, no pointer NULLing. - Ignored error (radeon_pm.c:1448) → teardown → btc_dpm.c:2727 calls it again → double free of every dyn_state pointer that was non-NULL at the first call (vddc/vddci/mvdd dependency entries, cac tables, ppm, cac_tdp, vce/uvd tables).

Attacker influence: allocation failure timing via heap grooming (the kzalloc sizes are small, kmalloc-32/64/256; a local unprivileged user can spray to force failure exactly once during drm attach — the parse runs at boot/attach, so the practical window is early-boot pressure or driver reload via kldunload/kldload on a system where the attacker can trigger module reload; on DFly the drm driver is typically compiled in, so the realistic trigger is boot-time pressure or a card hotplug event on a system so configured). Physical/proximity-gated: Medium with AC:H, consistent with DF-3755's rating.

Why not reproduced

Guest has no radeon GPU (env.txt) — neither the parse path nor the alloc-failure window can be entered. Recorded inconclusive/likely per the DF-3645/3755/3955 family convention.

Fix validation

not_testable (no hardware). fix.diff: NULL the pointers after every free on error paths and honor btc_dpm_init's return in radeon_pm_init_dpm (shared with DF-3972's half of the diff).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.