⬢ DragonFlyBSD Kernel Audit
DF-4854 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-4854",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Not runnable on the audit guest (no AMD GPU; the wptr comes from device DMA into the writeback shadow word). Code-certain by inspection: vega10_ih_get_wptr (vega10_ih.c:194-220) returns the device-DMAd wptr with only a ptr_mask and never validates 32-byte entry alignment, and amdgpu_ih_process (amdgpu_ih.c:154-157) walks with rptr stepping strictly 32 bytes. A misaligned wptr can never equal rptr: the amdgpu interrupt thread laps the 256 KiB ring forever with ih->lock held (amdgpu_ih.c:144) - all GPU interrupt delivery dead (DF-4843 twin with a 32-byte grid). Aggravator unique to this file: the RB_OVERFLOW recovery path (vega10_ih.c:210-213) keeps the wptrs 4-granular phase, so wptr=0x3FFDC|1 yields rptr=0x3FFFC and the first decode_iv (vega10_ih.c:327-334) reads ring words 0xFFFF..0x10006 - words 0x10002..0x10006 are 20 bytes past the ring_size+8 dma_alloc_coherent allocation (amdgpu_ih.c:61-68) - a hostile-GPU OOB read whose contents are decoded as an IV and also handed to amdgpu_amdkfd_interrupt (amdgpu_irq.c:170). Dispatch indices themselves are bounds-checked (amdgpu_irq.c:409-417). Hostile/faulting-device DoS + bounded OOB read; no uid0 route.",
  "exploit_chain": "",
  "evidence": "README.md (exact register arithmetic with path:line); VERDICT.md (proof + kill list); trigger_sketch.c (hostile-device write pattern)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:194",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:210",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:219",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:308",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:327",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:352",
    "sys/dev/drm/amd/amdgpu/vega10_ih.c:389",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:61",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:154",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:170",
    "sys/dev/drm/amd/include/asic_reg/oss/osssys_4_0_sh_mask.h:229"
  ],
  "poc_changes": "sketch only; no runnable PoC without a Vega10 GPU (hostile-device DMA source)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "DF-4843 (tonga_ih) twin, 32-byte entries vs 16. fix.diff intentionally omitted per policy for untested findings, same as DF-4843. Rest of file clean; see neg-evidence-panasonic-vega10-pass2/NOTES.md.",
  "recommended_fix": "in vega10_ih_get_wptr, after masking, round a misaligned wptr down to the 32-byte entry boundary with a warn (and align the overflow-recovery rptr identically); cap per-invocation entries in amdgpu_ih_process so a bad wptr cannot hard-spin the interrupt thread",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix validation not possible: finding is device-gated (no Vega10 GPU on the audit guest); recommended fix is static-only, mirroring DF-4843",
  "fix_evidence": "VERDICT.md Fix section; no fix_run.log/fix_build.log (no baseline repro possible)"
}