DF-4531 VERDICT

Classification: REAL BUG — inconclusive at runtime only because the QEMU audit guest has no DRM hardware. Source-level certainty is certain (every lock edge and every line of the control flow verified in-tree, plus a deterministic algorithmic proof of the overflow run on the guest 3/3).

Root cause chain (path:line)

1. sys/dev/drm/drm_sysctl.c:268 — DRM_LOCK(dev) = lockmgr(&dev->struct_mutex, LK_EXCLUSIVE) (drmP.h:114). This is the ONLY synchronization the handler has.
2. drm_sysctl.c:271-272 — pass 1 counts privcount entries of dev->filelist.
3. drm_sysctl.c:274-275 — kmalloc(..., M_WAITOK|M_NULLOK): sleeps, unbounded duration under memory pressure; even without sleeping, holding a lockmgr exclusive lock does not stop other CPUs.
4. drm_sysctl.c:281-282 — pass 2 copies *priv into the count-sized buffer with no bound check — list_for_each_entry simply runs to the end of the list.
5. sys/dev/drm/drm_file.c:514-516 — drm_open_helper() adds entries under mutex_lock(&dev->filelist_mutex) (mutex_lock = lockmgr(LK_EXCLUSIVE), include/linux/mutex.h:38) — a different lock object than struct_mutex. Nothing serializes it against steps 2-4.
6. sys/dev/drm/drm_file.c:380-382 + :430 — drm_close() removes under filelist_mutex and then kfree(file_priv) under no list lock at all (only drm_global_mutex): a shrinking/deleting race turns the walker into a use-after-free read.

Growth ⇒ OOB write of growth × sizeof(struct drm_file) (≈ 0x3c0+ bytes per entry on x86_64) past a kmalloc'd region whose size the attacker chose via the entry count at pass-1 time. The attacker fully controls:

• the base count N (open N fds before reading the sysctl),
• the growth (open fds from another thread during the read),
• the repeat rate (loop the sysctl read),
• part of the written content (pid, magic, capability bitfields), the rest being kernel heap pointers (idr roots, list heads) — useful fake-object material on a guest with no SMAP/SMEP/KASLR.

Shrink ⇒ UAF read (not directly user-visible; secondary).

Why High severity

Kernel heap buffer overflow, write primitive, reachable by a local unprivileged user in the video group (default desktop membership), with no DRM authentication and no master rights — just open(2) and sysctl(3). On the standard audit-guest configuration (no SMAP/SMEP/KASLR) a slab-groom → victim-object overwrite chain toward uid=0 is the expected escalation route; that end-to-end chain could not be developed here only because the guest lacks a DRM device (QEMU std-VGA, no i915/amdgpu, no virtio-gpu driver in the tree — verified: pciconf -l shows only vgapci0 with no drm child; /dev/dri absent; sysctl hw.dri ENOENT).

What was run (honest ledger)

Fix

fix.diff: hold dev->filelist_mutex (the lock all mutators already use) across both passes, release on the ENOMEM path, and bound pass 2 by the count with privcount = i after the copy so the print loop can never read uninitialized slots. Lock order is safe: no code path takes filelist_mutex before struct_mutex, so struct_mutex → filelist_mutex (the patched order) introduces no inversion. The M_WAITOK sleep under filelist_mutex is legal (lockmgr-based, sleepable) and bounded. fix_status: not_testable — runtime validation needs a DRM device; the patch compiles clean under the real kernel flags and makes the overflow unreachable by construction.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.