⬢ DragonFlyBSD Kernel Audit
DF-4871 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
{
  "finding_id": "DF-4871",
  "verdict": "untested",
  "impact": "none",
  "confidence": "likely",
  "summary": "r600_copy_dma discards the return values of radeon_sync_resv() and radeon_sync_rings(); on sync failure (e.g. -EINVAL syncing to a ring disabled by a failed ib test) the DMA copy is emitted without cross-ring ordering, silently corrupting the migrated bo's GPU contents",
  "kernel_refs": [
    "sys/dev/drm/radeon/r600_dma.c:466",
    "sys/dev/drm/radeon/r600_dma.c:467",
    "sys/dev/drm/radeon/radeon_sync.c:153",
    "sys/dev/drm/radeon/radeon_sync.c:160",
    "sys/dev/drm/radeon/radeon_ib.c:149",
    "sys/dev/drm/radeon/radeon_ttm.c:302"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "env.txt", "run.log", "manifest.json", "verdict.json"],
  "reproduce": {
    "build": "n/a — kernel-internal GEM bo-migration path",
    "run": "on real r6xx+ hardware: unprivileged GEM client forcing bo migrations (eviction) while the DMA ring source of a pending resv fence was disabled by a prior failed ib test / GPU reset; verify copied bo contents against the pre-move canonical contents",
    "expected": "without fix: copy committed despite radeon_sync_rings() returning -EINVAL, destination bo holds stale/partial data with a good fence; with fix.diff: copy path returns the error, ttm falls back to memcpy (radeon_ttm.c memcpy label)"
  }
}