DF-4397 — vega10_pp_tables_uninitialize leaks 8 subtable allocations per reload

Severity: Low (root-triggered unbounded kernel-heap growth) | Confidence: certain

What

sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1183-1228: vega10_pp_tables_uninitialize() frees only 9 of the ~17 allocations made by vega10_pp_tables_initialize()/init_powerplay_extended_tables()/ init_dpm_2_parameters(). Leaked on every teardown/re-init cycle:

Lifecycle: pp_dpm_set_pp_table (amdgpu_pm.c:676-700, sysfs pp_table, S_IWUSR) → amd_powerplay_reset → pptable_fini (hwmgr.c:261-281) + pptable_init — each reload leaks ~8 small allocations (typically a few hundred bytes to a few KB each, counts are u8-bounded). Rebind/ module reload cycles leak the same. Kernel-heap memory exhaustion over repeated root-triggered reloads (CWE-401). Upstream later rewrote this teardown to free everything.

Reproduce / validation

Static source diff (alloc list vs free list) is the proof — see VERDICT.md. Hardware-gated for runtime (no AMD GPU on the audit guest); fix.diff adds the 8 missing kfree pairs, git apply --check clean, and the patched file syntax-validates with 0 errors on the guest kernel toolchain (build.log).

DF-4397 VERDICT — uninitialize leak

Status: untested (hardware-gated; source-certain) | confidence: certain

Root cause

vega10_pp_tables_uninitialize() (vega10_processpptables.c:1183-1228) was written against an older version of the parser and never grew with it. Every table produced by init_powerplay_extended_tables() is kzalloc'd (vega10_processpptables.c:308, 387, 535, 569, 610, 676, 733, 776, 838) but only the 9 originals are kfree'd:

leaked per cycle: vdd_dep_on_socclk, vdd_dep_on_dcefclk, vdd_dep_on_pixclk, vdd_dep_on_phyclk, vdd_dep_on_dispclk, pcie_table, valid_socclk_values, valid_dcefclk_values (allocated at :926-929, :954-957, :936-940, :942-946, :948-952, :964-967, :986-988, :1000-1002).

Nothing else frees them: vega10_hwmgr.c's backend teardown frees only hwmgr->backend and dyn_state.vddc_dep_on_dal_pwrl (vega10_hwmgr.c:787-790); phm_hwmgr_backend_fini doesn't touch pptable members.

Trigger cadence

• /sys/class/drm/cardN/device/pp_table write (root only, S_IWUSR, amdgpu_pm.c:1007) → pp_dpm_set_pp_table (amdgpu_powerplay.c:676) → amd_powerplay_reset → pptable_fini + pptable_init (hwmgr.c:261-281) — leaks once per write.
• GPU unbind/rebind or module reload — leaks once per cycle.

Impact: unbounded kernel heap growth from a privileged trigger; each reload leaks 8 objects (tens of bytes to a few KB each). Low severity (DoS-by-memory-exhaustion needs sustained privileged action), CWE-401.

Verification

Runtime path needs an AMD Vega10 ASIC (absent on the audit guest — no 1002: PCI device, no /dev/dri). Source-certain: the alloc/free set difference above is mechanical. fix.diff adds the 8 missing kfree()+NULL pairs, git apply --check clean, and the patched file compiles with 0 syntax errors on the guest kernel toolchain (build.log).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.