⬢ DragonFlyBSD Kernel Audit
DF-4581 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4581",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Defect certain by inspection: radeon_cs.c:190-192 ignores the return of radeon_vm_get_bos(); on NULL (kvmalloc_array failure, radeon_vm.c:135-138) the VM page directory and page tables are silently omitted from p->validated, so they are neither reserved, validated/pinned, nor fenced for the submission, while radeon_cs_ib_vm_chunk proceeds to update the page directory via a DMA IB using radeon_bo_gpu_offset() of the now-unheld BOs -> stale-address GPU writes and unsynchronized eviction (race-grade GPU memory corruption). Not reproduced at runtime: the audit guest has no AMD GPU (no /dev/dri, no 1002: PCI device) so radeon_cs_ioctl is unreachable, and on DragonFly as compiled the NULL branch is itself unreachable because GFP_KERNEL kvmalloc never returns NULL (M_WAITOK without M_NULLOK; failure panics/hangs - see DF-4580 whose sink panic was reproduced on this guest). The bug is live upstream-shaped code and activates on DF as soon as allocator NULL semantics are introduced; fix must land together with DF-4580.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (line-accurate trace radeon_cs.c:190->radeon_vm.c:135-138->unreserved PD/PT update path radeon_cs.c:565); fix.diff (NULL check + -ENOMEM) git-apply-check clean.",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_cs.c:190",
    "sys/dev/drm/radeon/radeon_cs.c:196",
    "sys/dev/drm/radeon/radeon_cs.c:427",
    "sys/dev/drm/radeon/radeon_cs.c:565",
    "sys/dev/drm/radeon/radeon_vm.c:135",
    "sys/dev/drm/radeon/radeon_vm.c:147"
  ],
  "poc_changes": "No seed existed; authored DF-4581-trace.c as an annotated code-trace scaffold (no runtime possible: hardware absent + NULL path latent on DF).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a (needs radeon GPU + kvmalloc failure injection)",
  "code_hash": "n/a (code-trace scaffold only)",
  "notes": "Distinct from DF-4412 (that is the max_pde_used TOCTOU inside radeon_vm_get_bos in radeon_vm.c; this is the unchecked NULL return at the radeon_cs.c:191 call site). Latent on DF as compiled; live upstream. No runtime attempt possible on this guest (no AMD GPU), attempts=0 for that reason.",
  "recommended_fix": "Check radeon_vm_get_bos() return at radeon_cs.c:191: if NULL, DRM_ERROR and return -ENOMEM so the ioctl unwinds instead of submitting with an unreserved page directory.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and git-apply-check clean; not runnable on this guest (no radeon hardware, NULL path latent on DF as compiled).",
  "fix_evidence": "findings/poc/DF-4581/fix.diff; git apply --check passes."
}