DF-4378 — drm_drv.c minor teardown leaks the make_dev'd /dev/dri/cardN cdev and minor->kdev; stale node keeps si_drv1 dangling at the freed drm_device

• File: sys/dev/drm/drm_drv.c (root cause site: drm_minor_free() :176-196; companion drm_sysfs.c:97)
• Class: CWE-401/CWE-772 (missing resource release / dangling pointer after free) — Low
• Pass: 2 (GLM 5.3 re-audit); no known findings existed for this file
• Verdict: not_reproduced — hardware/module-gated: the audit QEMU guest has no DRM GPU; /dev/dri absent and no drm kld loaded (see run.log). Code defect certain from source (destroy_dev appears nowhere in sys/dev/drm).

What a maintainer needs to know

On DragonFly, each drm_minor allocation creates real kernel resources:

• drm_dev_init() → drm_minor_alloc() (drm_drv.c:130) → drm_sysfs_minor_alloc() (drm_sysfs.c:79) which kzallocs a struct device (:93) and make_dev()s the character device /dev/dri/cardN (:97-98), then drops the returned cdev on the floor (devnode local is never stored).

Teardown never releases either:

• drm_minor_free() (drm_drv.c:176-196) does idr_remove + kfree(minor) — put_device(minor->kdev) is #if 0 (:186-188), the kzalloc'd struct device leaks, and the cdev is never destroy_dev'd (rg destroy_dev sys/dev/drm → 0 hits).
• drm_dev_unregister() → drm_minor_unregister() (:237-260) only NULLs the idr slot and dev_set_drvdata(minor->kdev, NULL); the devfs node persists.
• After the final drm_dev_put() → drm_dev_fini() (:666-693) → drm_minor_free(), the surviving /dev/dri/cardN node's si_drv1 (set to the drm_device* at every open, drm_file.c:497) dangles at freed memory. New opens fail safely (drm_minor_acquire → idr_find → NULL → ENODEV), so the dangling pointer is not directly dereferenceable by users; the practical cost is: 1. a per-attach/detach-cycle leak of one cdev + one struct device per minor (driver reload, GPU hotplug), and 2. a stale /dev/dri/cardN entry that collides with the make_dev of the next attachment of the same minor index.

Trigger requires root (kldunload/devctl detach) or physical GPU hotplug — hence Low.

Build / Run / Expected

build.sh   # on the DragonFly guest: cc -o chk_drm chk_drm.c
run.sh     # ./chk_drm

Expected on hardware with a DRM driver: card nodes listed; the leak is observed by kldunload/kldload cycles (vmstat -m M_DRM growth, /dev/dri entry surviving unload).

Observed on this guest (run.log): DF-4378: /dev/dri absent → EXIT=2; kldstat shows only kernel/ehci/xhci; hw.drm sysctl unknown → drm core not even loaded.

Fix

fix.diff — store the cdev in struct drm_minor, destroy_dev() it and kfree(minor->kdev) in drm_minor_free() (with <sys/conf.h> included before the function).

DF-4378 VERDICT — not_reproduced (no DRM hardware/module on guest), defect certain from source

Reproduced?

No — the guest has no DRM device at all. chk_drm.c compiled and ran (BUILD_OK_4378, run.log): /dev/dri is absent, kldstat lists only kernel, ehci.ko, xhci.ko, and sysctl hw.drm is an unknown OID (the drm core module is not loaded — QEMU's emulated VGA is handled by the classic vga/vt console stack). The leak fires only when a DRM driver actually attaches (drm_dev_register → minors → make_dev) and then detaches; neither exists here.

Why the defect is certain anyway (path:line)

Resource creation (per minor, primary AND render):

• sys/dev/drm/drm_drv.c:158 — minor->kdev = drm_sysfs_minor_alloc(minor);
• sys/dev/drm/drm_sysfs.c:93 — kdev = kzalloc(sizeof(*kdev), GFP_KERNEL);
• sys/dev/drm/drm_sysfs.c:97-98 — devnode = make_dev(&drm_cdevsw, minor->index, DRM_DEV_UID, DRM_DEV_GID, DRM_DEV_MODE, "dri/%s", dev_str); — the returned cdev is stored in a local and never saved anywhere.

Resource release that never happens:

• sys/dev/drm/drm_drv.c:176-196 — drm_minor_free(): put_device(minor->kdev) is compiled out (#if 0, :186-188); the function does idr_remove + kfree(minor) only. Neither the struct device nor the cdev is released.
• sys/dev/drm/drm_drv.c:237-260 — drm_minor_unregister() NULLs the idr slot and dev_set_drvdata(minor->kdev, NULL); no destroy_dev.
• Whole-tree check: rg destroy_dev sys/dev/drm → zero matches. The devfs node outlives the driver forever.
• sys/dev/drm/drm_file.c:497 — kdev->si_drv1 = dev; is written at open time on the cdev; after drm_dev_fini() frees the drm_device (kref 0 → drm_dev_release → drm_dev_fini → drm_minor_free), the surviving node's si_drv1 is a dangling pointer. Users cannot reach it: post-unregister opens fail ENODEV in drm_minor_acquire() (drm_drv.c:271-290, idr slot NULLed under drm_minor_lock), and mmap requires a successful open first.

Exploitability: not a memory-safety primitive for an unprivileged user — a resource/lifetime hygiene bug (kernel heap leak per driver attach/detach cycle + stale devfs entry + name collision on re-attach of the same minor index). Trigger is privileged (kldunload/devctl) or physical (hotplug) → Low.

What I checked and killed on this file (pass-2 negatives)

• drm_minor_acquire/release (drm_drv.c:271-295): the kref is taken under drm_minor_lock and minors are only freed at dev-refcount 0 in drm_dev_fini, after unregister NULLed the idr slot — no acquire/free race.
• drm_stub_open (:1015-1053) and drm_release glue: #if 0 — dead on this port; real open/close are drm_open/drm_close (drm_file.c) with balanced acquire/release.
• drm_cdevpriv_dtor (:1194-1236): dead code — nothing in sys/dev/drm calls devfs_set_cdevpriv; had it been live, its missing kfree(file_priv) (and the duplicate release sequence vs drm_close) would double-release. Worth deleting.
• drm_mmap_single (:1256-1274): dev = kdev->si_drv1 looks unchecked-NULL, but si_drv1 is set by drm_open_helper before any fd exists, and an open fd pins the drm_device via the minor acquire ref → not reachable with NULL/dangling.
• dmi_found (:1281-1339): kgetenv() returns either a kmalloc'd copy (dynamic kenv) or a static pointer; kfreeenv() self-guards on kenv_isdynamic (kern_environment.c:229-251/332-336) → pairing is balanced, no bad free.
• drm_dev_init error path (:635-650): drm_minor_free is NULL-slot-guarded and idempotent; sysctl init/cleanup pairing is correct on every goto path.
• idr ranges (PRIMARY 0-63 / RENDER 64-127), controlD%d naming, busid_str ksnprintf sizing, drm_debug/tunable plumbing: all in-bounds/benign.

Fix validation

fix.diff authored against the read-only tree (adds struct cdev *devnode to struct drm_minor, stores the make_dev result, and destroys/frees both in drm_minor_free, with <sys/conf.h> included before the function). Not applied; fix validation not_testable — the guest cannot attach a DRM driver, so neither the baseline leak nor the patched behavior can be observed. The diff is compile-checkable by inspection (cdev_t == struct cdev *; incomplete-type member declaration is valid in drm_file.h; destroy_dev prototype comes from <sys/conf.h>).

Guest evidence

• run.log: uname, BUILD_OK_4378, /dev/dri absent, EXIT=2, kldstat (no drm), sysctl: unknown oid 'hw.drm'.
• env.txt: guest identity + absence summary.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.