⬢ DragonFlyBSD Kernel Audit
DF-4887 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
{
  "finding_id": "DF-4887",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Not runnable on the audit guest (no AMD GPU; the wptr source is device DMA into the host writeback slot, which software on the guest cannot produce). Code-certain by inspection - third instance of the just-filed DF-4843/DF-4854 family, confirmed SAME shape, not different: cik_ih_get_wptr reads the wb slot (cik_ih.c:190; use_bus_addr=false from cik_ih.c:321, so wb is the only path - CIK has NO IH doorbell, set_rptr uses mmIH_RB_RPTR at cik_ih.c:297-300) and returns it with nothing but &ptr_mask (cik_ih.c:205) - 16-byte alignment never validated. Core defect: amdgpu_ih_process (amdgpu_ih.c:154-157) walks with rptr stepping strictly 16 bytes (cik_ih.c:255 prescreen-drop, cik_ih.c:287 decode); a misaligned wptr without the overflow bit can never equal rptr - the amdgpu interrupt thread laps the 64KiB ring forever (4096 IVs re-dispatched/lap) with ih->lock held (amdgpu_ih.c:144) and restart_ih re-reading the same wptr (amdgpu_ih.c:163-165): one CPU pegged, all GPU IRQ delivery dead. Aggravator (DF-4854 shape, 12-byte variant): with RB_OVERFLOW set and overflow-cleared wptr in [0xFFE4..0xFFEF] (sub-16 phase 4..15 near ring end), the recovery rptr=(wptr+16)&0xFFFF (cik_ih.c:200) lands in [0xFFF4..0xFFFF], so the first prescreen/decode (cik_ih.c:243-246, 274-277) reads ring[ring_index..ring_index+3] with ring_index up to 0x3FFF -> dwords 0x4000..0x4002 = up to 12 bytes PAST the ring - and the CIK ring is an amdgpu_bo_create_kernel GTT BO of exactly ring_size (amdgpu_ih.c:80-88) with ZERO slack (the +8 slack only exists in the use_bus_addr path, amdgpu_ih.c:61-68), unlike vega10s 20B-past-a-slacked-allocation. OOB bytes are decoded as an IV, forwarded to amdgpu_amdkfd_interrupt (amdgpu_irq.c:170) and dispatched (dispatch indices separately bounds-checked). Prescreen/PASID (cik_ih.c:238-257) matches tonga: amdgpu_vm_pasid_fault_credit (amdgpu_vm.c:3370-3397) idr_find under pasid_lock, drop path advances rptr by 16 consistently - no cik-unique defect. Hostile/faulting-device model: DoS + <=12-byte read-only OOB read; no uid0 route; Low, consistent with the twins.",
  "exploit_chain": "",
  "evidence": "README.md (batch questions answered + exact arithmetic with path:line); VERDICT.md (proof + fix rationale); trigger_sketch.c (hostile-device write pattern for both defects); fix.diff (align-normalize + shared-walk cap)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/cik_ih.c:190",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:192",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:200",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:205",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:240",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:246",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:255",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:274",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:287",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:321",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:80",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:144",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:154",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:163",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:170",
    "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3370"
  ],
  "poc_changes": "sketch only; no runnable PoC without CIK hardware (device-DMA wptr source)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "DF-4843 (tonga, 16B grid, 64KiB ring) / DF-4854 (vega10, 32B grid, 256KiB) twin for the Sea Islands family; cik-unique delta: zero-slack exact-size GTT BO makes the OOB aggravator land 12B past a TTM BO mapping (no +8 slack), and no IH doorbell exists on CIK. Negative results: enable/disable paths (cik_ih.c:58-91,168-173) benign; irq_init register programming (cik_ih.c:104-159) benign incl. wb wptr addr lo/hi; is_idle/wait_for_idle/soft_reset register polling benign; decode field extraction (0xfffffff 28-bit mask at cik_ih.c:281 is upstream-inherited truncation, not OOB).",
  "recommended_fix": "in cik_ih_get_wptr, align-normalize the wptr to the 16-byte IV boundary after clearing RB_OVERFLOW (warn on mismatch) and derive the overflow-recovery rptr from the aligned value; cap per-invocation entries in amdgpu_ih_process so a bad wptr or storm cannot hard-spin the interrupt thread",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix validation not possible: finding is device-gated (no CIK GPU on the audit guest); fix mirrors the DF-4843/DF-4854 recommendation (align + walk cap), static-only",
  "fix_evidence": "fix.diff (git-apply-able vs read-only sys/ tree; never applied); VERDICT.md Fix section"
}