⬢ DragonFlyBSD Kernel Audit
DF-4838 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-4838",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The DragonFly MMU-notifier shim (sys/dev/drm/include/linux/mmu_notifier.h) is inert type scaffolding with no registration API and no VM-side callers, amdgpu_mn.c is absent from the amdgpu module SRCS (and cannot compile as-is: __mmu_notifier_register is undeclared anywhere and amdgpu_mn_ops initializes a nonexistent .invalidate_range_end member), CONFIG_MMU_NOTIFIER is never defined so amdgpu_mn.h compiles -ENODEV/NULL/no-op stubs, and amdgpu_gem_userptr_ioctl unconditionally returns -EINVAL with its body #if 0-ed. The feared GPU writes to revoked user memory primitive therefore has no object to operate on as shipped (verified on the guest: /boot/kernel/amdgpu.ko contains 0 amdgpu_mn symbols and the not implemented stub string). Latent: enabling the file without a real VM notifier implementation (the DF-4819 dead-shrinker pattern) plus the stripped-from-upstream struct amdgpu_mn.kref (amdgpu_mn_get returns hash hits unrefcounted) would yield missed-invalidation DMA and a p->mn UAF.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4838/run.log (guest: nm amdgpu.ko grep -c amdgpu_mn = 0; kconfig grep count 0; Makefile grep rc=1; stub string present; aac.ko likewise debug-free); VERDICT.md full path:line chain; static_check.sh runnable re-proof",
  "kernel_refs": [
    "sys/dev/drm/include/linux/mmu_notifier.h:36",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.c:416",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.c:132",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.c:356",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.c:72",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.c:397",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.h:37",
    "sys/dev/drm/amd/amdgpu/amdgpu_mn.h:52",
    "sys/dev/drm/amd/amdgpu/amdgpu_gem.c:285",
    "sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1222",
    "sys/dev/drm/radeon/Makefile:107"
  ],
  "poc_changes": "n/a \u2014 absence proof, no seeded PoC to repair; static_check.sh + guest run.log authored fresh",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 38,
  "guest_dirty": 0,
  "build_cmd": "sh findings/poc/DF-4838/static_check.sh",
  "run_cmd": "dfbsd-qemu/vm.sh run_root nm /boot/kernel/amdgpu.ko | grep -c amdgpu_mn; strings /boot/kernel/amdgpu.ko | grep amdgpu_gem_userptr_ioctl",
  "code_hash": "c675fef8614c4f5ef5d4c99767c9866fd91a377db2758623f9ec577c34490840",
  "notes": "Info by policy (DF-4586 i915 sibling precedent: same family, userptr creation closed, impact none as shipped). Verification skipped per contract for Info findings; static+binary absence proof recorded instead. Guest left clean (no module loads, no dirt).",
  "recommended_fix": "Keep userptr closed until sys/vm gains real MMU-notifier hooks; restore upstreams struct amdgpu_mn.kref (kref_get on the amdgpu_mn_get hash hit) per fix.diff; document the inert shim at amdgpu_mn.hs stub branch.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No runtime defect to A/B on the shipped kernel (code is compiled out); fix.diff restores upstream kref parity and adds an explicit warning so the dead path cannot be silently re-enabled against the inert shim.",
  "fix_evidence": "findings/poc/DF-4838/fix.diff (sha256 90ab0086a130b350e784ae630c4bee8fc7a08e1615d827c5fb69c57d45958b85), authored against read-only sys/, never applied"
}