⬢ DragonFlyBSD Kernel Audit
DF-4643 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-4643",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Proven statically, not executable on the audit guest (no AMD GPU; amdgpu is kldload-only). dce_virtuals crtc_irq .set callback (dce_virtual.c:744 -> :715 -> hrtimer_cancel at :736) is always invoked from amdgpu_irq_update under spin_lock_irqsave(&adev->irq.lock) (amdgpu_irq.c:458-468). The DF hrtimer emulations hrtimer_cancel (linux_hrtimer.c:121-150) may taskqueue_drain -> ssleep (subr_taskqueue.c:490-495) and lwkt_setcpu_self (CPU migration) \u2014 illegal in the atomic context Linux hrtimer semantics guarantee, so every vblank enable/disable (amdgpu_kms.c:1172-1194, user-triggerable via DRM ioctls) can sleep or migrate while holding the exclusive display-irq lock: display-irq-path stall/deadlock exposure, compounding the known un-cancellable-timer defects DF-2174/DF-2175 (distinct root cause: blocking/migrating cancel vs active-flag corruption). Expected impact dos; gated by AMD hardware + amdgpu.virtual_display=1 -> Medium.",
  "exploit_chain": "",
  "evidence": "README.md/VERDICT.md carry the complete traced chain with path:line for every hop; guest facts (no AMD PCI device, amdgpu absent from GENERIC) recorded in notes.",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/dce_virtual.c:736",
    "sys/dev/drm/amd/amdgpu/dce_virtual.c:744",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:458",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:467",
    "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:1172",
    "sys/dev/drm/linux_hrtimer.c:121",
    "sys/dev/drm/linux_hrtimer.c:140",
    "sys/dev/drm/linux_hrtimer.c:144",
    "sys/kern/subr_taskqueue.c:490",
    "sys/dev/drm/include/linux/spinlock.h:75",
    "sys/dev/drm/include/linux/irqflags.h:34"
  ],
  "poc_changes": "none \u2014 no PoC seed; driver not loadable on guest",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Phase V not possible: guest dmesg/pciconf show only QEMU virtual VGA (vgapci0, chip 0x1111:1234); amdgpu builds only as a kld module (sys/dev/drm/amd/amd/Makefile) and is not in X86_64_GENERIC. Do not conflate with DF-2174 (active-flag: cancel returns without stopping systimer) or DF-2175 (hrtimer_start re-init corrupts systimer queue) \u2014 this finding is the atomic-context contract violation of hrtimer_cancel reached from dce_virtuals .set.",
  "recommended_fix": "Defer hrtimer arm/cancel out of the .set callback in dce_virtual.c (record state, act from a work item), or make the DF hrtimer emulations hrtimer_cancel non-blocking in atomic context.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No runtime verification was possible (no AMD hardware); sketch of the local fix is in VERDICT.md.",
  "fix_evidence": "VERDICT.md fix section."
}