DF-4523
cik_sdma_ib_test leaks the IB (SA-bo) and its fence on fence-wait error/timeout — reachable after every GPU reset while a DMA engine stays wedged
Summary
Both early exits on fence-wait failure/timeout skip radeon_ib_free while every other exit performs it. ib_test runs at init/resume and after every GPU reset; an unpriv GPU client wedging the SDMA forces reset cycles, each leaking one 256-dw IB from the fixed-size shared pool plus its fence - progressive exhaustion until ib_get fails system-wide (persistent GPU-accel DoS). Free-on-both-exits fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4523 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 940 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: no AMD GPU on guest
fix in finding markdown
per-fix-DF-4523
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Both fence-wait early exits skip radeon_ib_free while every other exit performs it. Unpriv GPU client wedges SDMA -> reset cycles -> leak per cycle. Free-on-both-exits fix.
Verdict
not_run: no CIK radeon hardware on guest; ib_test runs at init/resume/after every GPU reset
No comments yet.