⬢ DragonFlyBSD Kernel Audit
DF-4169 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
{
  "finding_id": "DF-4169",
  "verdict": "reproduced",
  "impact": "panic",
  "severity": "Medium",
  "confidence": "certain",
  "reproduce": {
    "build": "cd rig && sh build.sh /usr/src   # 26 verbatim blocks checker-proven byte-identical on the guest; builds rig_base (verbatim slice) + rig_fixed (same slice + fix.diff)",
    "run": "cd rig && sh run.sh                # 11 modes x {baseline, fixed}; decisive modes: 4169-boot-chain, 4169-null-adjust-rules, 4169-null-get-sclk, 4169-level0-get-sclk, 4169-level0-perf-unclamped, 4169-level0-shallow-sleep, 4169-boot-chain-control, clean-valid",
    "expected": "baseline: SIGSEGV WRITE at NULL+0x30 (smu8_apply_state_adjust_rules :1051, exactly the filed offset), SIGSEGV READ at NULL+0x4 and NULL+0x44 (smu8_dpm_get_sclk :1319/:1321 via NULL cast), ~64GB wild reads = levels[0xFFFFFFFF] (:1321/:1601, level==0), OOB read 324B past the 320B state allocation (smu8_get_performance_level :1571-1572 clamp defeat); boot-chain-control and clean-valid pass. fixed build: all 4169 modes return -EINVAL with no fault; clean-valid byte-identical; 4171 modes still fault (orthogonal). Three runs byte-identical (run.log, run.2.log, run.3.log)."
  },
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:51",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:59",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1041",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1051",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1066",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1316",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1319",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1321",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1569",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1571",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1601",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:53",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:90"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "env.txt",
    "fix.diff",
    "build.log",
    "run.log",
    "run.2.log",
    "run.3.log",
    "verdict.json",
    "manifest.json",
    "rig/gen_rig.sh",
    "rig/check_verbatim.sh",
    "rig/rig_shims.h",
    "rig/smu8_rig.c",
    "rig/Makefile",
    "rig/build.sh",
    "rig/run.sh",
    "rig/smu8_slice.inc",
    "rig/smu8_slice_fixed.inc",
    "rig/smu8_slice_verbatim.h",
    "rig/rig_fix.diff"
  ]
}