β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5143

GFP_DMA32 <4GiB constraint for I965G/GM internal objects is dead code on DragonFly β€” shim alloc_pages ignores gfp_mask, so pre-gen6 32-bit GTT PTEs truncate >4GiB physical addresses and the GPU DMAs to aliased physical pages

Summary

The driver sets __GFP_DMA32 because '965gm cannot relocate objects above 4GiB' but the DFly alloc_pages shim ignores gfp_mask entirely (alloc_page DOES honor it - an oversight) and dma_map_sg is a pass-through: on I965G/GM with >4GiB RAM, internal-object pages can land above 4GiB, the 32-bit PTEs alias an unrelated low physical page, and the GPU silently corrupts/discloses arbitrary low physical memory. Vanishing hardware population gates it at Low; mechanism certain. Honor-DMA32-in-the-shim fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5143 Β· 1 files
FileTypeDescriptionSize
verdict.json file 908 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5143

Confirmed kernel references

Detail

Evidence (decisive lines)

source trace in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (latent kernel-internal API / hardware-gated I965G/GM)