DF-4117 — Dangling rdev->pm.dpm.ps + ignored cypress_dpm_init error: double free in cypress_dpm_fini (cypress dispatch) ================================================================== File: sys/dev/drm/radeon/cypress_dpm.c — pass 2 (GLM 5.3). Cypress-dispatch instance of the DF-3645/3755/3955/3973/4023 family (shared root site rv770_dpm.c:2306-2310; btc twin DF-3973, rv770 twin DF-4023 — same class, this file's own consumption sinks).

MECHANISM (all path:line in VERDICT.md): * rv7xx_parse_power_table kzalloc(ps_priv) failure mid-loop kfree's rdev->pm.dpm.ps WITHOUT NULLing it; num_ps stays 0; ps_priv[0..i-1] leak (rv770_dpm.c:2306-2310). * cypress_dpm_init:2050-2052 propagates the error but leaves rdev->pm.dpm.priv set (also leaks eg_pi on the earlier r600_get_platform_caps failure). * radeon_pm.c:1448 discards .dpm.init's return; evergreen.c:5235 calls radeon_pm_init() as a void statement — attach completes with dpm_enabled=false and ps dangling. * unload/reboot: radeon_pm_fini_dpm -> radeon_dpm_fini runs UNCONDITIONALLY (radeon_pm.c:1705) -> cypress_dpm_fini:2150-2153: num_ps==0 skips the ps_priv loop (leak), kfree(rdev->pm.dpm.ps) DOUBLE-FREES the block freed at parse time.

TRIGGER (hardware-gated): evergreen-family GPU + crafted many-state VBIOS + memory pressure at attach; unload/reboot detonates. IMPACT: kmalloc double free (heap corruption/panic at detach); realistic ceiling DoS (trigger point is boot/attach + root unload). Hardware absent on audit guest => runtime inconclusive, source-level certain (family precedent: DF-3973/DF-4023 packs). FIX: fix.diff (parse error path cleanup + init cleanup + idempotent fini), mirrors the accepted family fixes.

DF-4117 VERDICT — double free in cypress_dpm_fini via dangling dpm.ps

STATUS: inconclusive (runtime hardware-gated; no evergreen GPU on the audit guest); mechanism source-certain; family convention per DF-3973/DF-4023. impact ceiling (not demonstrated): heap corruption / panic at unload. confidence: certain.

CHAIN (path:line): 1. rv7xx_parse_power_table (SHARED, rv770_dpm.c:2271-2333): kzalloc(rv7xx_ps) failure inside the state loop at :2306-2310 executes kfree(rdev->pm.dpm.ps) (:2308) WITHOUT setting it to NULL, WITHOUT freeing the ps_priv[0..i-1] stored earlier, and returns -ENOMEM before num_ps is assigned (:2331) — num_ps stays 0. 2. cypress_dpm_init (cypress_dpm.c:2050-2052) propagates the error but leaves rdev->pm.dpm.priv = eg_pi (allocated :2032-2035); the earlier r600_get_platform_caps failure (:2046-2048) returns without cleanup as well (eg_pi leak). 3. The error is swallowed TWICE: radeon_pm.c:1448 radeon_dpm_init(rdev); discards .dpm.init's int return, and every asic init calls radeon_pm_init() as a void statement (evergreen.c:5235 for this family). radeon_pm.c:1449 assigns current_ps/requested_ps = boot_ps (NULL, see DF-4118), then calls radeon_dpm_setup_asic + radeon_dpm_enable; enable fails (or panics per DF-4118); attach completes with dpm_enabled=false and rdev->pm.dpm.ps DANGLING. 4. Detonation: radeon_pm_fini (unload/reboot) -> radeon_pm_fini_dpm (radeon_pm.c:1690) -> radeon_dpm_fini UNCONDITIONALLY (:1705, not gated on dpm_enabled) -> cypress_dpm_fini (cypress_dpm.c:2146-2155): the i < num_ps loop skips (num_ps == 0) so the i parsed ps_priv states LEAK, then kfree(rdev->pm.dpm.ps) at :2153 double-frees the block freed at step 1 — kmalloc freelist corruption, typically panic at unload/reboot; on a foreign reclaim, memory-safety consequences in principle (realistic trigger point is boot/attach under memory pressure + root unload — ceiling DoS).

RELATION TO KNOWNS: this file's knowns (DF-1385/1386/1387) do not cover lifecycle. The btc/rv770 twins (DF-3973/DF-4023) established the shared root; the cypress dispatch (radeon_asic.c:1405 for CYPRESS/HEMLOCK/JUNIPER/REDWOOD/CEDAR) consumption is this finding.

FIX: fix.diff — (1) shared parse error path frees ps_priv[0..i-1] and NULLs rdev->pm.dpm.ps; (2) cypress_dpm_init frees eg_pi on early failure; (3) cypress_dpm_fini NULLs ps/priv after kfree. Kernel-level fix validation impossible on this guest (no hardware); fix_status not_testable. Diff is the same shape already validated for the btc twin family (DF-3973).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.