⬢ DragonFlyBSD Kernel Audit
DF-3646 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3646",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain NULL deref, radeon/ci twin of DF-3586 (amdgpu kv/ci), DF-3610 (radeon si), DF-3623 (amdgpu ci). rdev->pm.dpm.boot_ps is assigned in exactly one place: ci_parse_pplib_non_clock_info (ci_dpm.c:5500-5501), only when some parsed power state has ATOM_PPLIB_CLASSIFICATION_BOOT set in its VBIOS classification flags. A crafted VBIOS whose state array omits that flag leaves boot_ps NULL; nothing else initializes it (grep across sys/dev/drm/radeon: only the per-asic parse functions set it). radeon_pm_init_dpm then stores NULL into current_ps/requested_ps (radeon_pm.c:1449) and ci_dpm_enable -> ci_init_smc_table takes radeon_boot_state = rdev->pm.dpm.boot_ps (ci_dpm.c:3593) and passes it to ci_populate_smc_initial_state (3675), whose first act is ci_get_ps(rps): return rps->ps_priv (ci_dpm.c:197) - a read at NULL+offsetof(ps_priv) - followed by boot_state->performance_levels[0].sclk (2629). ci_dpm_enables own ci_update_current_ps(rdev, boot_ps) at 5317 would copy *rps from NULL as well. Boot-time kernel panic (NULL-page fault). Upstream Linux master is identical (verified against torvalds/linux ci_dpm.c). Not runtime-reproducible on this virtio-only guest.",
  "exploit_chain": "Crafted VBIOS on a CI-class card without any BOOT-classified power state -> NULL-page kernel read at driver load -> panic. Pure DoS; no control over the dereference contents. (Hardware-gated; no kernel PoC possible on this guest.)",
  "evidence": "VERDICT.md (full source trace); env.txt (guest has no AMD GPU: pciconf 0x1002 count=0, /dev/dri absent, no drm kld); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/radeon/ci_dpm.c:5500",
    "sys/dev/drm/radeon/ci_dpm.c:3593",
    "sys/dev/drm/radeon/ci_dpm.c:3675",
    "sys/dev/drm/radeon/ci_dpm.c:2623",
    "sys/dev/drm/radeon/ci_dpm.c:2629",
    "sys/dev/drm/radeon/ci_dpm.c:5200",
    "sys/dev/drm/radeon/ci_dpm.c:5317",
    "sys/dev/drm/radeon/radeon_pm.c:1449"
  ],
  "poc_changes": "n/a \u2014 no seeded PoC; source-trace only",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "pass 2 radeon/ci_dpm.c; twins: DF-3586/DF-3610/DF-3623. Guest virtio-only per task; harness scratch files under /root removed.",
  "recommended_fix": "Reject a NULL boot_ps early: return -EINVAL from ci_init_smc_table and ci_dpm_enable when rdev->pm.dpm.boot_ps is unset.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation would require a CI-class GPU with a crafted VBIOS (baseline panic/corruption) and a single-fix kernel build; the audit guest is virtio-only, so the fix is source-reviewed only (fix.diff).",
  "fix_evidence": "fix.diff in this pack; not applied to sys/ (read-only audit target)."
}