⬢ DragonFlyBSD Kernel Audit
DF-4713 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-4713",
  "verdict": "untested (runtime) - hardware-gated: no AMD GPU on guest; unchecked funcs->process/funcs->set calls are source-certain with in-tree NULL providers; fix compile-validated (full amdgpu module build, -Werror, MOD_BUILD_RC=0)",
  "impact": "hardirq NULL function-pointer call (kernel panic / local DoS ceiling) if an IV reaches a .process-less source (dce_virtual crtc_irq at LEGACY/229); reset-path NULL .set panic if a num_types>0 source without .set is ever registered",
  "confidence": "likely",
  "reproduce": {
    "build": "guest# cd /usr/src && patch -p1 < /tmp/df4713_fix.diff && cd sys/dev/drm/amd/amdgpu && make obj && make",
    "run": "n/a (guest has only virtio-gpu 1af4:1234; amdgpu never binds)",
    "expected": "MOD_BUILD_RC=0; patched amdgpu_irq.c compiled at -Werror (build.log:119); amdgpu.ko linked"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:359",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:436",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:467",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:134",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:520",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:550",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:488",
    "sys/dev/drm/amd/amdgpu/dce_virtual.c:375",
    "sys/dev/drm/amd/amdgpu/dce_virtual.c:757",
    "sys/dev/drm/amd/amdgpu/sdma_v4_0.c:1748",
    "sys/dev/drm/amd/amdgpu/amdgpu_device.c:3287"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff", "build.log", "env.txt",
    "manifest.json", "verdict.json", "build.sh"
  ]
}