DF-4855 — agp_amd64: attach error paths leak GATT/resources and leave a live /dev/agpgart on an unattached device

What

agp_amd64_attach() (sys/dev/agp/agp_amd64.c:159-243) has three error exits that fire after agp_generic_attach() succeeded at :183:

183:    if ((error = agp_generic_attach(dev)))
184:        return (error);
...
204:    switch (pci_get_vendor(dev)) {
205:    case 0x10b9:    /* ULi */
206:        agp_amd64_uli_init(dev);
207:        if (agp_amd64_uli_set_aperture(dev, sc->initial_aperture))
208:            return (ENXIO);            /* <-- no unwind */
...
211:    case 0x10de:    /* nVidia */
212:        agp_amd64_nvidia_init(dev);
213:        if (agp_amd64_nvidia_set_aperture(dev, sc->initial_aperture))
214:            return (ENXIO);            /* <-- no unwind */
...
217:    case 0x1106:    /* VIA */
218:        sc->via_agp = agp_amd64_via_match();
219:        if (sc->via_agp) {
220:            agp_amd64_via_init(dev);
221:            if (agp_amd64_via_set_aperture(dev, sc->initial_aperture))
222:                return (ENXIO);        /* <-- no unwind */

agp_generic_attach() (agp.c:196-245) has already: - bus_alloc_resource'd the aperture BAR (agp.c:209), - make_dev(&agp_ops, 0, UID_ROOT, GID_WHEEL, 0600, "agpgart") with si_drv1 = dev (agp.c:240-242).

And sc->gatt was already allocated via agp_alloc_gatt() (agp_amd64.c:189, stored at :202; up to entries * 4 = 2 MiB of contigmalloc, agp.c:146).

When these return (ENXIO) fire, newbus never calls agp_amd64_detach() (detach is only invoked for successfully-attached devices), so nothing ever runs agp_free_cdev / agp_free_gatt / agp_free_res.

Consequences

1. Leaked kernel memory: the GATT (contiguous, up to 2 MiB) plus the aperture bus resource leak on every failed attach.
2. Orphaned live cdev: /dev/agpgart (0600 root:wheel) remains registered pointing at a half-initialized, unattached device: agp_open/agp_ioctl never check device_is_attached(). Root holding the node can AGPIOC_ALLOCATE + AGPIOC_BIND; the bind lands in sc->gatt — which is set (allocated at :202 before the failing switch) — but the GART was never installed: the ATTBASE/APCTRL-GARTEN config-write loop at agp_amd64.c:229-238 never ran, so the hardware ignores every entry written. (No memory-safety violation occurs in the driver itself; the GATT writes are in-bounds — ag_entries is u_int32_t, agppriv.h:83, so the ag_entries << AGP_PAGE_SHIFT bound at :333/:347 promotes correctly to 64-bit.)
3. Same defect class as DF-1986 (agp_via.c:180-183, filed Low) — this is the agp_amd64.c instance.

Trigger (hardware-gated)

sc->initial_aperture comes from the AMD64 GART APCTRL register (agp_amd64.c:186, table at :265-273: 32M..2G). The vendor sub-tables are strictly smaller: - ULi M1689 accepts 32/64/128/256 MB (agp_amd64.c:398-406) → BIOS aperture ≥ 512 MB ⇒ EINVAL ⇒ ENXIO. - nForce3 accepts 32..512 MB (agp_amd64.c:433-441) → BIOS aperture ≥ 1 GB ⇒ EINVAL ⇒ ENXIO. - VIA: aperture math (agp_amd64.c:470-472) validates every power-of-two, so the VIA exit needs an actual config-write anomaly.

So: boot or kldload agp on an AMD-8151/SiS-75x/ULi-M1689/nForce3/VIA-K8 board whose BIOS programmed a larger-than-vendor-max aperture. Requires matching 2003-2005-era hardware; the cdev is 0600, so the ioctl surface is root-only regardless.

Guest verification (honest negative)

The QEMU/i440FX guest has exactly one host bridge, 0x12378086 (Intel 82441) — no id in agp_amd64_match()'s table (agp_amd64.c:87-112) can match, agp_amd64_probe returns ENXIO for every device, /dev/agpgart does not exist, and the trigger program (built clean on the guest) gets ENOENT from both root and nobody. The failure path cannot execute on this guest; the defect is proven statically by the line trace above. Verdict: not_reproduced (hardware absent), confidence certain in the code defect.

Fix

Unwind in the error paths (authoritative fix.diff next to this file):

--- a/sys/dev/agp/agp_amd64.c
+++ b/sys/dev/agp/agp_amd64.c
@@ -204,10 +204,13 @@ agp_amd64_attach(device_t dev)
    switch (pci_get_vendor(dev)) {
    case 0x10b9:    /* ULi */
        agp_amd64_uli_init(dev);
-       if (agp_amd64_uli_set_aperture(dev, sc->initial_aperture))
-           return (ENXIO);
+       if (agp_amd64_uli_set_aperture(dev, sc->initial_aperture)) {
+           error = ENXIO;
+           goto err;
+       }
        break;

(with matching goto err at the nVidia and VIA sites, and err: agp_free_gatt(sc->gatt); agp_generic_detach(dev); return (error); after the switch.)

Alternatively (defense in depth, fixes every chipset driver at once): move the make_dev() out of agp_generic_attach() into a post-attach step, or make agp_open/agp_ioctl reject unattached devices.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.