⬢ DragonFlyBSD Kernel Audit
DF-2214 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
{
  "finding_id": "DF-2214",
  "target": "sys/dev/drm/radeon/rv770_dma.c:42-94 (defect at :57)",
  "class": "verbatim-code KLD rig (radeon/amdgpu parser-rig class; sibling: DF-2167 evergreen twin)",
  "verdict": "reproduced",
  "impact": "gpu_integrity_silent_truncation",
  "confidence": "certain",
  "reproduce": {
    "build": "cd findings/poc/DF-2214 && ./build.sh",
    "run": "cd findings/poc/DF-2214 && ./run.sh",
    "expected": "BASELINE pages=0x00100000: scheduled_bytes=0 fence_emitted=1 -> SILENT_TRUNCATION; pages=0x000fffff: 100.0000% FULL_COPY; real64K ring: 0x000fffff -> ERR_PTR(-12) loud vs 0x00100000 -> silent no-op; FIXED: 100.0000% everywhere >=2^20, bit-identical below"
  },
  "provenance": {
    "tree_file_sha256": "b33101a3cce7eba62ac2d1dda4e1ec0f7225028942cdbb1cafd1c9a2670e33d9",
    "verbatim_lines_42_94_sha256": "c1b2d82ab166f9e04f7158a8d6fe0506d22ee1c6f05aca121ca0ac9b5a6b547c",
    "checks": "guest tree == audited tree; line-range extraction == pattern extraction; fixed variant == fix.diff applied to same bytes; assembled source contains each verbatim byte block exactly once"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/rv770_dma.c:57",
    "sys/dev/drm/radeon/rv770_dma.c:58",
    "sys/dev/drm/radeon/rv770_dma.c:69-81",
    "sys/dev/drm/radeon/rv770_dma.c:83-93",
    "sys/dev/drm/radeon/radeon.h:645",
    "sys/dev/drm/radeon/radeon.h:2708-2717",
    "sys/dev/drm/radeon/radeon_ring.c:107-127",
    "sys/dev/drm/radeon/rv770d.h:663-669",
    "sys/dev/drm/radeon/rv770.c:1968",
    "sys/dev/drm/radeon/radeon_ttm.c:radeon_move_blit"
  ],
  "fix": {
    "status": "fixed",
    "validation": "A/B in same KLD: baseline truncates silently at >=2^20; fix.diff variant schedules 100.0000% (or fails loudly ERR_PTR(-12) on the real 64 KiB ring); sub-2^20 bit-identical",
    "diff": "fix.diff"
  },
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "rig_head.c",
    "rig_tail.c",
    "verbatim_baseline.c",
    "verbatim_fixed.c",
    "df2214_rig.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "run_extract.log",
    "run2_extract.log",
    "run3_extract.log",
    "run_dmesg.log",
    "kldload_panic_iteration.txt",
    "fix.diff",
    "env.txt",
    "manifest.json",
    "verdict.json"
  ]
}