⬢ DragonFlyBSD Kernel Audit
DF-4554 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
  "finding_id": "DF-4554",
  "title": "amdgpu_debugfs: gpr_read VGPR path (bank 0) copies an uninitialized 4KB kmalloc to userspace when read_wave_vgprs is NULL (gfx_v7/v8) — survives a DF-1692 fix; latent (CONFIG_DEBUG_FS undefined)",
  "verdict": "not_reproduced",
  "impact": "none",
  "reproduce": {
    "build": "n/a (kernel debugfs handler; compiled out on DFly)",
    "run": "on a system with the handlers compiled (e.g. upstream Linux, CIK/VI GPU): open /sys/kernel/debug/dri/0/amdgpu_gpr, lseek 0 (bank=VGPR), read 4096 -> uninitialized heap bytes",
    "expected": "bug: non-zero kernel-pointer-like uninitialized data; fix: -EINVAL"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:710",
    "sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:718",
    "sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:729",
    "sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:732",
    "sys/dev/drm/amd/amdgpu/gfx_v7_0.c:4283",
    "sys/dev/drm/amd/amdgpu/gfx_v8_0.c:5325",
    "sys/dev/drm/amd/amdgpu/gfx_v9_0.c:1378",
    "sys/dev/drm/kconfig.h:1"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "run.sh", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}