⬢ DragonFlyBSD Kernel Audit
DF-4684 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-4684",
  "verdict": "reproduced",
  "impact": "none",
  "title": "amdgpu_fence_wait_empty: dead dma_fence_get_rcu bail — racing reader resurrects and uses an already-released fence (double-free tail blocked by refcount_inc saturation on this port)",
  "reproduce": {
    "build": "cd /root/poc/DF-4684 && make -m /usr/share/mk KMODDIR=$PWD   # df4684.ko (stock headers)",
    "run": "kldload drm && kldload ./df4684.ko && sysctl kern.df4684_run=1; sleep 6; dmesg | tail -15",
    "expected": "reader :307 dma_fence_get_rcu(...) = <ptr>, refcount resurrected to 3221225472 (REFCOUNT_SATURATED); RESULT: releases=1 frees=1 (double-free tail blocked; upstream bails at :307)"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_fence.c:295-316",
    "sys/dev/drm/amd/amdgpu/amdgpu_fence.c:244-265",
    "sys/dev/drm/amd/amdgpu/amdgpu_fence.c:631-649",
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:2133-2146",
    "sys/dev/drm/include/linux/dma-fence.h:97-103",
    "sys/dev/drm/include/linux/rcupdate.h:46-56",
    "sys/dev/drm/include/linux/refcount.h:39,53-60",
    "sys/dev/drm/linux_rcu.c:56-78",
    "sys/dev/drm/linux_fence.c:44-51"
  ],
  "artifacts": [
    "df4684.c", "Makefile", "build.sh", "run.sh",
    "build.log", "run.log", "run.fixed.log",
    "fix.diff", "VERDICT.md", "README.md", "env.txt",
    "build_kernel.log", "verdict.json", "manifest.json"
  ]
}