__drm_legacy_pci_free consumes never-initialized tag/map: the DF port broke the _DRM_CONSISTENT map's alloc/free contract — drm_pci_alloc's descriptor is kfree'd at addmap, the rmmap path forges it on the stack with only vaddr/busaddr/size, and the DF bus_dma teardown then runs bus_dmamap_unload/bus_dmamem_free/bus_dma_tag_destroy on uninitialized stack pointers while the real tag/map/DMA memory leak permanently
Summary
The DF port added tag/map to the free primitive without updating the callers: the descriptor (with the only real tag/map) is kfree'd at addmap (permanent DMA-memory+map+tag leak per CONSISTENT map), and rmmap's stack-forged handle leaves tag/map as garbage consumed by bus_dma teardown. Upstream consumes exactly the three forged fields - DF-specific break. Latent in-tree (no DRIVER_LEGACY driver); detonation via RM_MAP (DRM_AUTH-only) or master-drop once a legacy driver exists. Keep-the-descriptor fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4909 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.5 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
root ADDMAP(_DRM_CONSISTENT) -> descriptor freed, tag/map discarded -> any DRM_AUTH client RM_MAP (or master-drop) -> bus_dma teardown on stack garbage -> panic/corruption
Evidence (decisive lines)
findings/poc/DF-4909/ (this verdict; sink provably reads fields no caller writes)
Verdict
Latent (no in-tree DRIVER_LEGACY driver; CAP_SYS_ADMIN + feature-gated creation): the DF port broke the _DRM_CONSISTENT alloc/free contract - drm_pci_alloc returns a descriptor carrying tag+map, addmap kfrees it immediately (keeping only vaddr/busaddr in the map, so every CONSISTENT map leaks its DMA memory+map+tag forever), and rmmap FORGES the handle on the stack setting only vaddr/busaddr/size, so the DF __drm_legacy_pci_free runs bus_dmamap_unload/bus_dmamem_free/bus_dma_tag_destroy on uninitialized stack pointers (wild bus_dma teardown - panic at minimum, groomed kfree at worst). Upstream Linux's free primitive consumes exactly the three forged fields - this break is DF-specific. Detonation paths once a legacy driver exists: RM_MAP is DRM_AUTH-only (unpriv after root creates one map) or master-drop auto-cleanup. Keep-the-descriptor fix.
No comments yet.