⬢ DragonFlyBSD Kernel Audit
DF-3900 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3900",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain teardown asymmetry: i915_mmio_setup() pci_iomap()s the MMIO BAR (i915_drv.c:1027) into pmap_mapdev KVA + a global iomap_list node + a shim bus-resource hold, but the only pci_iounmap in the whole i915 tree is #if 0d out in i915_mmio_cleanup() (i915_drv.c:1042-1049) and intel_uncore_fini() (intel_uncore.c:1643) never unmaps. Every i915 attach/detach cycle (root kldload/kldunload i915kms.ko or error-probe-retry) permanently leaks 512KB/2MB KVA plus metadata; unbounded accumulation; DF-3768s twin for a different resource. Not runnable on the audit guest (virtio VGA only, no /dev/dri \u2014 kldload i915kms: No such file or directory), so honestly inconclusive with the code path proven by rg across the tree.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (step-by-step proof); run.log (guest kldload attempt fails: no i915 hardware); mmio_leak_cycle.sh (hardware trigger); fix.diff (un-#if 0 pci_iounmap)",
  "kernel_refs": [
    "sys/dev/drm/i915/i915_drv.c:1027",
    "sys/dev/drm/i915/i915_drv.c:1040",
    "sys/dev/drm/i915/i915_drv.c:1048",
    "sys/dev/drm/i915/i915_drv.c:1103",
    "sys/dev/drm/i915/i915_drv.c:1866",
    "sys/dev/drm/linux_iomapping.c:44",
    "sys/dev/drm/include/linux/pci.h:299"
  ],
  "poc_changes": "Trigger authored fresh (kldload cycle script); no seed existed",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "none (shell trigger)",
  "run_cmd": "sh mmio_leak_cycle.sh 2 (hardware only); guest attempt logged in run.log",
  "code_hash": "sha256:f40d7c430b6fd354d258f49ce9aa20cf1835b255c24871de4e99546bfb1fcc7f",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff un-#if 0s pci_iounmap(pdev, dev_priv->regs) in i915_mmio_cleanup; not build-validated (guest cannot build/load i915kms; no reproduced corruption to gate mandatory fix-validation)",
  "fix_evidence": "fix.diff in this directory",
  "notes": "Aggravator: pci_resource_start shim (include/linux/pci.h:267) also never releases its bus_alloc_resource_any \u2014 affects all drm drivers; shim file outside this findings scope. DF-3768 (GGTT fictitious range) remains a separate leak on the same unload path.",
  "recommended_fix": "Compile the pci_iounmap(pdev, dev_priv->regs) back into i915_mmio_cleanup() (and NULL dev_priv->regs)"
}