⬢ DragonFlyBSD Kernel Audit
DF-4685 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
{
  "finding_id": "DF-4685",
  "verdict": "reproduced",
  "impact": "panic",
  "title": "amdgpu_fence_slab_fini: rcu_barrier() is a no-op — kldunload with pending call_rcu entries unmaps module text before the >=1s delay line fires amdgpu_fence_free → fatal trap (root-triggered local DoS)",
  "reproduce": {
    "build": "cd /root/poc/DF-4684 && make -m /usr/share/mk KMODDIR=$PWD   # df4684.ko (stock headers)",
    "run": "kldload drm && kldload ./df4684.ko && sysctl kern.df4684_run=2 && kldunload df4684; sleep 4",
    "expected": "kldunload completes; ~1s later: Fatal trap 12 page fault at the armed callback address (unmapped module text); guest drops to db> (panic.txt)"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_fence.c:69-73",
    "sys/dev/drm/amd/amdgpu/amdgpu_fence.c:646-649",
    "sys/dev/drm/include/linux/rcutree.h:30",
    "sys/dev/drm/linux_rcu.c:56-78,80-110"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "run.sh", "panic.txt",
    "run.fixed.log", "fix.diff", "manifest.json", "verdict.json"
  ]
}