⬢ DragonFlyBSD Kernel Audit
DF-4838 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4838",
  "file": "sys/dev/drm/amd/amdgpu/amdgpu_mn.c",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "description": "amdgpu MMU-notifier invalidation entirely absent on DragonFly: inert <linux/mmu_notifier.h> shim (no registration API, no VM hooks), amdgpu_mn.c excluded from the module build (and non-compilable as-is), CONFIG_MMU_NOTIFIER undefined so amdgpu_mn.h stubs return -ENODEV/NULL/no-op, and amdgpu_gem_userptr_ioctl hard-fails -EINVAL. Latent missed-invalidation DMA + stripped-kref p->mn UAF if ever enabled.",
  "reproduce": {
    "build": "sh findings/poc/DF-4838/static_check.sh",
    "run": "dfbsd-qemu/vm.sh run_root 'nm /boot/kernel/amdgpu.ko | grep -c amdgpu_mn; strings /boot/kernel/amdgpu.ko | grep amdgpu_gem_userptr_ioctl'",
    "expected": "0 amdgpu_mn symbols in the shipped module; 0 CONFIG_MMU_NOTIFIER defines; Makefile grep no match; stub string 'amdgpu_gem_userptr_ioctl: not implemented' present in the binary"
  },
  "kernel_refs": [
    "sys/dev/drm/include/linux/mmu_notifier.h:36-46",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.c:416",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.c:132",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.c:356-367",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.c:72-90",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.c:397-399",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.h:37-57",
    "sys/dev/drm/amd/amdgpu/amdgpu_gem.c:285-290",
    "sys/dev/drm/amd/amdgpu/amdgpu_cs.c:605",
    "sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1222",
    "sys/dev/drm/radeon/Makefile:105-107"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "static_check.sh",
    "run.log",
    "fix.diff",
    "verdict.json",
    "manifest.json"
  ]
}