⬢ DragonFlyBSD Kernel Audit
DF-4608 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4608",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "radeon_vce_cs_reloc() dereferences p->chunk_relocs (NULL when the DRM_IOCTL_RADEON_CS submission omits the RADEON_CHUNK_ID_RELOCS chunk, which radeon_cs_parser_init accepts and radeon_cs_parser_relocs silently tolerates by returning 0) at radeon_vce.c:482 -> fixed-offset NULL read -> kernel panic. Deterministic single-ioctl local DoS for any user with DRM node access on SI/CIK radeon hardware with VCE. Both sibling paths guard this exact case (generic radeon_cs.c:846-850 and radeon_uvd.c:705-709 print No relocation chunk ! and return -EINVAL); the VCE parser simply forgot. The audit guest has no radeon GPU (no /dev/dri, zero 1002: PCI devices), so the trigger could not be executed -- trigger builds clean on the guest and is provided ready for affected hardware; code-trace certainty per VERDICT.md.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4608/VERDICT.md (six-step path:line proof chain); vce_null_relocs.c (raw-ioctl trigger, no libdrm); build.log (clean guest build); run.log (hardware-absence proof)",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_vce.c:478",
    "sys/dev/drm/radeon/radeon_vce.c:482",
    "sys/dev/drm/radeon/radeon_vce.c:646",
    "sys/dev/drm/radeon/radeon_cs.c:83",
    "sys/dev/drm/radeon/radeon_cs.c:313",
    "sys/dev/drm/radeon/radeon_cs.c:846",
    "sys/dev/drm/radeon/radeon_uvd.c:705",
    "sys/dev/drm/radeon/radeon_asic.c:1769"
  ],
  "poc_changes": "n/a (first evidence pack; trigger authored from scratch against the DF radeon source with hand-rolled _IOWR ioctl, no libdrm)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64 (guest has no radeon GPU: pciconf lists no 1002: device, /dev/dri absent)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o vce_null_relocs vce_null_relocs.c",
  "run_cmd": "./vce_null_relocs /dev/dri/renderD128",
  "code_hash": "550ea9a6c43363760248fa34ec26c1cf68f38bc05110db6b96b72ee53e4341ed",
  "notes": "Hardware-required finding (radeon SI/CIK ASIC with VCE block); QEMU guest lacks the device, so no execution attempt was possible -- status untested per audit precedent (cf. DF-4447). Upstream Linux radeon carries the same unguarded deref; the equivalent amdgpu parser rejects missing relocs.",
  "recommended_fix": "Add if (p->chunk_relocs == NULL) { DRM_ERROR(\"No relocation chunk !\\n\"); return -EINVAL; } at the head of radeon_vce_cs_parse(), mirroring radeon_uvd.c:705-709 (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (UVD-equivalent guard); no radeon hardware on the audit guest, so no kernel build/run validation is possible.",
  "fix_evidence": "findings/poc/DF-4608/fix.diff"
}