DF-4281
drm_addmap_core leaks vmalloc'd SHM maps, WC MTRR registrations and CONSISTENT DMA memory on error paths
Summary
Two error paths free only the kmalloc'd drm_local_map but not the resources it acquired: kzalloc(list) failure (SHM vmalloc_user never freed; FRAME_BUFFER/REGISTERS-WC arch_phys_wc_add never deleted; CONSISTENT dma leaks outright) and drm_map_handle failure (same omissions). Repeatable per attempt under memory pressure. Root-only. Teardown-mirror fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4281 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 230 B | ↓ raw | |
| verdict.json | file | 782 B | view raw |
README.md
file
↓ download raw
DF-4281
No DRM device on audit guest - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: mirror the rmmap type-specific teardown (vfree SHM handle, arch_phys_wc_del, drm_pci_free) on both error paths
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
mirror the rmmap type-specific teardown (vfree SHM handle, arch_phys_wc_del, drm_pci_free) on both error paths
source-only
per-fix-DF-4281
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; full path:line trace in pass-2 result block
Verdict
source-verified; no DRM device nodes on audit guest
No comments yet.