DF-4065

Missing linux-4.19.y stable backports 690e0ec8e63d + 85636167e320: legacy ring buffers still allocated from stolen memory and BAR/WC-mapped on LLC platforms — upstream direction is 'never do this on LLC' (GPU hangs/wedges); DFly carries the pre-fix v4.19 state

Summary

intel_ring_create_vma allocates the ring from stolen memory unconditionally and pin/unpin BAR-map it with no HAS_LLC guard. Upstream added exactly these guards in the 2023 stable pair (690e0ec8e63d + 85636167e320, Cc stable v4.9+) with the rationale that stolen/BAR should never be used for ring buffers on LLC platforms (caching pitfalls -> stale ring reads, lost flushes, GPU hangs). The port took the 2018 stable backports for this file but not this pair, so on every supported LLC platform with stolen memory exposed the CPU->GPU ring path uses the caching-hostile combination. Diff-certain divergence; hardware-gated runtime (no Intel GPU model in QEMU). Three one-line-guard fix.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — drivers
Confidence: likely
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE: CWE-1188
File: sys/dev/drm/i915/intel_ringbuffer.c
Lines: 1096-1148
Area: dev
Discovered: 2026-09-17
Updated: 2026-09-17

Team triage

untriaged

priority: — · owner: —

PoC verification

untested

Status: untested
Reproduced: no
Impact: Missing linux-4.19.y stable backports 690e0ec8e63d + 85636167e320: legacy ring buffers still allocated from stolen memory and BAR/WC-mapped on LLC platforms (SNB+) - upstream direction 'never do this on LLC' (GPU hangs/wedges, display wedge/GPU DoS).
Confidence: likely
Tested: 2026-09-17 21:47:37
Attempts: 0
Runtime: —
Code hash: —
Guest: —
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: no
Patched reproduced: no
Confidence: likely
Tested: 2026-09-17 21:47:38
Runtime: —
Kernel: per-fix-DF-4065
fix.diff: findings/poc/DF-4065/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4065 · 2 files

File	Type	Description	Size
README.md	file		287 B	↓ raw
verdict.json	file		1.2 KB	view raw

README.md file

↓ download raw

DF-4065 — intel_ringbuffer.c missing 2023 !HAS_LLC stable backports

Low / hardening divergence: rings from stolen + BAR/WC-mapped on LLC platforms. Diff-certain vs linux-4.19.y; hardware-gated runtime. Fix = the upstream pair (690e0ec8e63d, 85636167e320). PoC skipped per contract.

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

apply upstream stable pair 690e0ec8e63d + 85636167e320 (three one-line !HAS_LLC guards: stolen alloc gate + pin/unpin BAR-map gates)

source-only (upstream diff)

per-fix-DF-4065

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

diff-certain: intel_ringbuffer.c:1096/:1131/:1148 lack the !HAS_LLC guards present in linux-4.19.y

Verdict

source-verified via full diff vs upstream v4.19 and linux-4.19.y; hardware-gated (no Intel GPU model in QEMU)