⬢ DragonFlyBSD Kernel Audit
DF-4854 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-4854",
  "title": "vega10_ih: unvalidated device-DMA'd IH wptr (DF-4843 twin) — permanent interrupt-thread spin on misaligned wptr + 20-byte OOB ring read via RB_OVERFLOW recovery",
  "file": "sys/dev/drm/amd/amdgpu/vega10_ih.c",
  "lines": [194, 220],
  "verdict": "untested",
  "impact": "dos",
  "confidence": "certain",
  "threat_model": "hostile/faulting GPU (device DMA), DF-4755/4756 model",
  "reproduce": {
    "build": "n/a — hardware-bound; see trigger_sketch.c for the hostile-device write pattern",
    "run": "n/a — requires Vega10 GPU writing the IH wptr shadow",
    "expected": "primitive 1: amdgpu interrupt thread spins forever, ih->lock held, all GPU IRQs dead; primitive 2: words 0x10002..0x10006 read past the 0x40008-byte ring allocation"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:194",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:210",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:219",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:327",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:352",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:389",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:61",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:154",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:170",
    "sys/dev/drm/amd/include/asic_reg/oss/osssys_4_0_sh_mask.h:229"
  ],
  "artifacts": ["README.md", "VERDICT.md", "verdict.json", "manifest.json", "trigger_sketch.c"],
  "fix": "fix.diff omitted per policy for untested findings; recommended shape in verdict.json recommended_fix"
}