⬢ DragonFlyBSD Kernel Audit
DF-4413 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4413",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Partial-commit bug certain by trace: radeon_vm_bo_set_addr() inserts the mapping into vm->va/vm->cleared (radeon_vm.c:519-526) before the PT loop, and the error returns at radeon_vm.c:554-560 leave it there with vm->page_tables[pt_idx].bo == NULL; the next update (GEM_VA UNMAP cleanup, CS reloc, eviction invalidate) walks radeon_vm_update_ptes() which dereferences pt->tbo.resv at radeon_vm.c:833 with pt==NULL -> kernel panic. The audit guest has no radeon GPU (/dev/dri absent, std VGA) so the panic cannot be triggered at runtime; trigger compiles and runs, exits at open()=ENOENT (run.log). Analysis-classified impact: local kernel panic/DoS from an unprivileged DRI client (Medium).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (commit-before-alloc trace + three crash sinks); run.log (device-absent); fix.diff (rollback on failure)",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_vm.c:519",
    "sys/dev/drm/radeon/radeon_vm.c:554",
    "sys/dev/drm/radeon/radeon_vm.c:828",
    "sys/dev/drm/radeon/radeon_vm.c:833",
    "sys/dev/drm/radeon/radeon_gem.c:586",
    "sys/dev/drm/radeon/radeon_cs.c:527"
  ],
  "poc_changes": "kernel uapi include replaced by self-contained radeon_abi.h (uapi chain broken for userspace on DFly)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 10,
  "guest_dirty": 1,
  "build_cmd": "cc -O2 -Wall -o /tmp/trigger_nullpt DF-4413/trigger_nullpt.c",
  "run_cmd": "/tmp/trigger_nullpt",
  "code_hash": "19448245241569cf36ad1f026e2121239721b54bdb0316104c82999e7a495988",
  "notes": "Deterministic postcondition once PT allocation fails under memory pressure (VRAM+GTT exhaustion beats TTM eviction). The cleanup GEM_VA UNMAP of the failed mapping is itself a trigger.",
  "recommended_fix": "Roll the mapping back out of vm->va/vm->cleared before returning the allocation error",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix validation impossible on this guest (no radeon GPU; bug not triggerable). fix.diff adds an error_rollback path that removes the committed interval under the proper locks.",
  "fix_evidence": "fix.diff (error_rollback: interval_tree_remove + status_lock-protected reset)"
}