DragonFlyBSD Kernel Audit
DF-1863 / run.log
← back to finding ↓ download raw
DF-1863 amdgpu_ctx_add_fence TOCTOU harness  (N_THREADS=2, ITERS=4000)
----------------------------------------------------------
BUGGY  : iters=8000  double_put=1825  live_fences=1858  occupied_slots=32  leaked=1826
FIXED  : iters=8000  double_put=0  live_fences=32  occupied_slots=32  leaked=0
----------------------------------------------------------
RESULT: BUGGY variant produced 1825 double dma_fence_put() events and 1826 leaked fences => confirms TOCTOU primitive.
        On the kernel this is a use-after-free / double-free
        of struct dma_fence (drm_sched_fence) in kmalloc.