⬢ DragonFlyBSD Kernel Audit
DF-4356 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-4356",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "DragonFly-port teardown-order divergence, source-certain: amdgpu_kms.c:1073-1074 runs amdgpu_vm_fini BEFORE amdgpu_ctx_mgr_fini, while upstream Linux v5.0/v5.2/v5.4 (all fetched and verified this session) invariantly finish contexts first so their scheduler entities and in-flight jobs quiesce before the VM page tables are freed. With the DF order, amdgpu_vm_fini frees all GPU page tables (amdgpu_vm.c:3348 amdgpu_vm_free_pts), drops the PASID and destroys vm->entity while context jobs can still be executing or queued: the scheduler threads amdgpu_job_dependency (amdgpu_job.c:193-198) calls amdgpu_vmid_grab on the torn-down VM (amdgpu_ids.c:406-459) and executing IBs walk freed page tables -> device-side UAF -> GPU faults/hang/reset (system-wide GPU DoS); the DF scheduler port additionally dropped upstreams dma_fence_wait(last_scheduled) in drm_sched_entity_fini (sched_entity.c:263-292), removing any other barrier. Runtime reproduction is hardware-gated: the audit QEMU guest has no AMD GPU, no /dev/dri and no amdgpu UAPI header (all verified, run.log/env.txt), so status is inconclusive, consistent with prior amdgpu PoCs DF-1467/DF-1595. Fix is the two-line swap restoring the upstream order (fix.diff, apply-check OK on guest /usr/src, compile-validated by patched buildkernel).",
  "exploit_chain": "unprivileged render-node client: open /dev/dri/renderD128 -> AMDGPU_CTX alloc -> AMDGPU_CS submit (long-running IB) -> close(fd) racing scheduler -> postclose frees page tables under executing job -> GPU page-table UAF -> GPU VM fault/ring hang -> device reset (system-wide GPU loss). Cross-process VRAM disclosure via freed-PT reuse is theoretically open but unproven without hardware.",
  "evidence": "VERDICT.md sections 1-3 (upstream v5.0/v5.2/v5.4 citations; amdgpu_vm.c:3300-3351 teardown inventory; amdgpu_job.c:193-198 + amdgpu_ids.c:406-459 post-teardown derefs; sched_entity.c:263-292 missing wait); run.log + env.txt (guest hardware-absent proof); fix_apply_check.log; trigger.c (compile-ready race trigger); fix.diff + fix_build.log (patched kernel build)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:1073",
    "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:1074",
    "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3311",
    "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3348",
    "sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:569",
    "sys/dev/drm/amd/amdgpu/amdgpu_job.c:193",
    "sys/dev/drm/amd/amdgpu/amdgpu_ids.c:406",
    "sys/dev/drm/scheduler/sched_entity.c:263"
  ],
  "poc_changes": "n/a (no seed PoC existed; trigger.c authored fresh; runtime blocked by absent hardware, not by code defects)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 90,
  "guest_dirty": 1,
  "build_cmd": "cc -O2 -o trigger trigger.c (guest lacks drm/amdgpu_drm.h - cannot build there; host-side build only)",
  "run_cmd": "./trigger /dev/dri/renderD128",
  "code_hash": "88efca4a81c93200c1804ae83ec1b273eecea9b78285424c53f79618a6b6452b",
  "notes": "Hardware-gated finding (no AMD GPU on audit guest) - matches house style of DF-1467/DF-1595 (inconclusive). Aggravator noted for triage: sys/dev/drm/scheduler/sched_entity.c:263-292 dropped upstreams dma_fence_wait in drm_sched_entity_fini (that file is pass-1 clean; separate pass-2 follow-up recommended). Guest /usr/src was patched and a buildkernel run for compile validation; guest reset with-src performed at end of run.",
  "recommended_fix": "Swap amdgpu_ctx_mgr_fini() before amdgpu_vm_fini() in amdgpu_driver_postclose_kms to restore the upstream Linux teardown order.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 (buildkernel compile-validation only; behavioral fix test needs AMD GPU)",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff restores the upstream (ctx-then-vm) order. patch --dry-run apply-check passed on the guests pristine /usr/src (fix_apply_check.log, pristine md5 c38b5273...); with the fix applied the whole amdgpu module rebuilt cleanly (make -j6 in sys/dev/drm/amd/amdgpu -> amdgpu.ko, amdgpu_kms.o zero warnings, mod_done_0 - full log in fix_build.log). Behavioral validation (close-race with in-flight CS on real hardware) is not possible on this GPU-less guest, hence not_testable rather than fixed.",
  "fix_evidence": "fix_apply_check.log (DF-4356_APPLY_CHECK_OK, pristine md5 c38b5273f3ad36ab64d5fc2fd782fdbb); fix_build.log (FULL 777-line module build: amdgpu_kms.o compiled zero-warnings, amdgpu.ko linked, mod_done_0)"
}