DF-4459 — drm_gem_init: unchecked mm kzalloc (NULL-deref panic under OOM), partial-failure leaks, and dangling dev->mm_private

Verify (static, against the audit tree)

sh run.sh sys/dev/drm/drm_gem.c    # prints the asymmetry + dangling assignment

Build (fix compile-validation)

sh build.sh (inside guest, fixed drm_gem.c staged) — drm.ko rebuilds -Werror clean, RC=0 (build.log).

Files

• VERDICT.md — root cause with line cites, trigger analysis
• run.sh + run.log — static verification of the defect in-tree
• build.sh + build.log — patched module build
• fix.diff — NULL-check both allocations; assign dev->mm_private only after drm_ht_create succeeds; free both on failure

DF-4459 — PoC Verification Verdict

File: sys/dev/drm/drm_gem.c (pass 2), drm_gem_init() at drm_gem.c:130-163. Guest: DragonFly 6.5-DEVELOPMENT (X86_64_GENERIC), cc 8.3.

Verdict: INCONCLUSIVE at runtime (code defect Certain; OOM-gated)

Root cause

139:    mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
140:    vma_offset_manager = kzalloc(sizeof(*vma_offset_manager), GFP_KERNEL);
141:    if (!vma_offset_manager) {              /* <-- mm is NOT checked */
142:        DRM_ERROR("out of memory\n");
143:        return -ENOMEM;
144:    }
146:    dev->mm_private = mm;
148:    if (drm_ht_create(&mm->offset_hash, 12)) {
149:        kfree(mm);                       /* <-- dev->mm_private dangles */
150:        return -ENOMEM;
151:    }

Three defects on the OOM paths:

1. NULL-deref panic: if kzalloc(mm) (139) fails while kzalloc(vma_offset_manager) (140) succeeds, execution proceeds to drm_ht_create(&mm->offset_hash, 12) (148) — a NULL pointer offset dereference inside the drm hashtable create (&NULL->offset_hash, dereferenced by drm_ht_create) → kernel panic. Unprivileged users can drive the system into kernel-memory exhaustion (GFP_KERNEL allocations fail under pressure), but the allocation here happens at drm device registration (module load / device attach), so the practical trigger is memory pressure coinciding with a drm (re)load.
2. Memory leak: on the !vma_offset_manager path (141-144), mm (139) is leaked.
3. Dangling dev->mm_private: dev->mm_private = mm (146) is assigned before drm_ht_create can fail; the failure path kfrees mm (149) without clearing dev->mm_private — later drm_gem_destroy() runs drm_mm_takedown(&mm->offset_manager) (170) and drm_ht_remove (171) on freed memory (UAF), and every drm_gem_create_mmap_offset_size() in between dereferences the stale pointer (drm_gem.c:570, 576-577). (vma_offset_manager is likewise leaked on this path.)

Upstream FreeBSD checks both allocations (if (!mm) …); the DragonFly port dropped the mm check and reordered the assignment.

Reproduction

Not runtime-reproducible: the only trigger is kzalloc(GFP_KERNEL) failure during drm device init — not injectable on the QEMU guest (no fault-injection knob for this site, and no drm hardware; force-loading drm.ko without hardware wedges the loader). Static verification of the defect: run.sh (greps the tree, run.log); the data-flow is fully cited above.

Fix validation

fix.diff checks both allocations, frees both on failure, and moves dev->mm_private = mm after the drm_ht_create success point. Compile-validated on the guest: drm.ko rebuilt with the patch, -Werror, RC=0 (build.log; combined with the sibling DF-4458/DF-4460 hunks). git apply --check passes against the pristine tree. fix_status=not_testable (no OOM injection / no drm hardware), compile-validated.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.