amdgpu userptr machinery is dead-but-armed: usertask is never set, so re-enabling GEM_USERPTR instantly NULL-derefs in amdgpu_ttm_tt_get_user_pages; gup shim has an inverted KKASSERT; ttm->sg is freed without NULLing (double-free shape)
Summary
The port stubs AMDGPU_GEM_USERPTR to EINVAL while keeping the full userptr backend compiled - amdgpu_cs.c still calls get_user_pages(). set_userptr never assigns gtt->usertask (the assignment is #if 0), so the first statement of get_user_pages ('mm = gtt->usertask->mm') is a guaranteed NULL-deref the moment the ioctl is re-enabled - the guard is after the deref. The gup shim compounds it with an inverted KKASSERT(td->td_proc == NULL) followed by td->td_proc->p_vmspace. pin_userptr failure path kfrees ttm->sg without NULLing (double-free shape); bind-error paths leak pinned pages. Landmine one untested re-enablement away.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4018 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 283 B | ↓ raw | |
| verdict.json | file | 1.1 KB | view raw |
DF-4018
Low/Info finding — PoC skipped per contract (hardware-gated / dead code). Source citations in the pass-2 result block.
Fix: finish the port (set usertask with get_task_struct, fix the shim assert, NULL ttm->sg after kfree, symmetric cleanup) or delete the dead backend
Fix verification
not_testablefinish the port (set usertask with get_task_struct, fix the shim assert, NULL ttm->sg after kfree, symmetric cleanup) or delete the dead backend
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; path:line citations in pass-2 result block
Verdict
source-verified; dead as shipped (ioctl returns EINVAL); landmine one untested re-enablement away
No comments yet.