DF-4460 — drm_gem_create_mmap_offset_size commits hash+unr publication before drm_vma_offset_add is known to succeed; failure leaves on_map=true and a retry returns success with no vma offset

Verify (static)

sh run.sh sys/dev/drm/drm_gem.c

Build (fix compile-validation)

sh build.sh (inside guest, fixed drm_gem.c staged) — drm.ko rebuilds -Werror clean, RC=0 (build.log).

Files

• VERDICT.md — ordering analysis, retry hole, impact ceiling
• run.sh + run.log — static proof
• build.sh + build.log — patched module build
• fix.diff — unwind publication on drm_vma_offset_add failure

DF-4460 — PoC Verification Verdict

File: sys/dev/drm/drm_gem.c (pass 2), drm_gem_create_mmap_offset_size() at drm_gem.c:566-588. Guest: DragonFly 6.5-DEVELOPMENT (X86_64_GENERIC), cc 8.3.

Verdict: INCONCLUSIVE at runtime (code defect Certain; hardening/Info)

Root cause

576:    obj->map_list.key = alloc_unr(mm->idxunr);
577:    ret = drm_ht_insert_item(&mm->offset_hash, &obj->map_list);
578:    if (ret != 0) { ... free_unr ... return ret; }   /* balanced */
583:    obj->on_map = true;
585:    return drm_vma_offset_add(dev->vma_offset_manager, &obj->vma_node,
586:                  size / PAGE_SIZE);

The DragonFly-side publication (unr idx + legacy offset hash) is committed at 576-583 before the Linux-side drm_vma_offset_add() result is known. When drm_vma_offset_add() fails (drm_mm insert failure — ENOMEM/sp exhausted range after DRM_FILE_PAGE_OFFSET_SIZE is carved out, drm_vma_manager.c:200-215), the function returns the error but leaves:

• obj->on_map = true and the hash item + unr idx committed, and
• the early-return retry hole: a subsequent drm_gem_create_mmap_offset[_size]() sees obj->on_map (573-574) and returns 0 — reporting success while obj->vma_node still has no offset. On the Linux ->mmap path drm_vma_node_offset_addr() would then return 0 and callers hand userspace a bogus 0 offset; on the DragonFly d_mmap_single path the object is still findable via the legacy hash (the DF offset scheme at i915_gem.c:2647-2649 uses map_list.key, not vma_node), so the user-visible effect is limited to the leaked idx+hash slot held until object release (drm_gem_free_mmap_offset, 529-546, self-heals via the same on_map flag) and the inconsistent state.

Severity: Info (resource lifetime inconsistency, self-healing leak of a 22-bit unr idx + hash bucket per failure; no demonstrated memory safety impact).

Reproduction

Trigger = drm_vma_offset_add() failure = drm_mm range exhaustion / ENOMEM inside GEM offset creation — not injectable on the QEMU guest (no drm hardware; no fault-injection knob). Static proof: run.sh / run.log prints the committed-before-checked ordering in-tree.

Fix validation

fix.diff unwinds the publication (drm_ht_remove_item + free_unr + on_map=false) when drm_vma_offset_add fails. Compile-validated on the guest: drm.ko rebuilt with the patch, -Werror, RC=0 (build.log; combined with sibling DF-4458/DF-4459 hunks). git apply --check passes against the pristine tree. fix_status=not_testable (trigger not injectable), compile-validated.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.