vega10_smu_init error path kfrees hwmgr->smu_backend without NULLing it, defeating vega10_smu_fini's NULL guard — latent double-free/UAF (the vega12 DF-4951 shape)
Summary
free_backend kfrees without the NULL assignment the success-time fini has - fini's 'if (priv)' guard passes a dangling pointer, so any fini-after-failed-init double-frees. status.sw-gated on this tree (leak only); goes live on any error-unwind change. One-line NULL fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4994 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.1 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
vega10 smu_init failure -> dangling backend -> later sw_fini -> double free / bo ops on freed memory
Evidence (decisive lines)
findings/poc/DF-4994/ (this verdict)
Verdict
Latent double-free/UAF (Low, hw-gated + status.sw-gated on this tree): vega10_smu_init's free_backend label kfrees hwmgr->smu_backend WITHOUT NULLing it - vega10_smu_fini's only defense is 'if (priv)' and a dangling non-NULL passes it, so any fini-after-failed-init re-kfrees the backend and runs amdgpu_bo_free_kernel on freed memory (the vega12 DF-4951 shape; the success-time fini has exactly the missing NULL at :316). On this tree the IP status.sw gating blocks it (a leak only); it goes live the moment any path calls sw_fini after a failed sw_init. One-line NULL fix.
No comments yet.