⬢ DragonFlyBSD Kernel Audit
DF-4976 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-4976",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Real object-lifetime gap, proven by trace, not executable on the audit guest (no AMD GPU / no SR-IOV VF). xgpu_ai_mailbox_put_irq (mxgpu_ai.c:365-369) \u2014 called from soc15_common_hw_fini (soc15.c:843-846) on every detach/suspend/gpu-recovery teardown \u2014 drops the two irq sources but never cancel_work_sync/flush_works adev->virt.flr_work; no other code drains it either. A flr_work queued by the RCV irq just before teardown (host/PF sends IDH_FLR_NOTIFICATION, mxgpu_ai.c:294-296) survives and then executes xgpu_ai_mailbox_flr_work (mxgpu_ai.c:235-271) against a device being torn down \u2014 mutex on adev->lock_reset, 500 ms of MMIO peeks, amdgpu_device_gpu_recover(adev) \u2014 and at driver detach continues past drm_dev_put into use-after-free of the kzallocd adev (amdgpu_kms.c:180, freed with dev_private). cancel_work_sync exists in the DFly shim (workqueue.h:131) and is already used for adev->reset_work at amdgpu_irq.c:279/310, so the omission is a genuine bug. Guest-local users can widen the recovery variant by forcing TDR via /dev/dri, but queueing itself is host-timed; rated Low like the family (DF-4755).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4976/VERDICT.md (trace); decisive refs: mxgpu_ai.c:365-369 (no cancel), soc15.c:843-846 (put_irq at hw_fini), mxgpu_ai.c:287-296 (queue site), mxgpu_ai.c:235-271 (post-teardown touches), amdgpu_kms.c:180 + amdgpu_drv.c:974 (alloc/free of adev), workqueue.h:131 + amdgpu_irq.c:279 (idiom exists)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/mxgpu_ai.c:365-369",
    "sys/dev/drm/amd/amdgpu/mxgpu_ai.c:287-296",
    "sys/dev/drm/amd/amdgpu/mxgpu_ai.c:235-271",
    "sys/dev/drm/amd/amdgpu/soc15.c:843-846",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:541-562",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:279",
    "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:75",
    "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:180",
    "sys/dev/drm/amd/amdgpu/amdgpu_drv.c:974",
    "sys/dev/drm/amd/amdgpu/amdgpu_virt.h:246",
    "sys/dev/drm/include/linux/workqueue.h:131"
  ],
  "poc_changes": "No runnable PoC exists: needs a Vega20-class SR-IOV VF whose PF times an FLR notification into a teardown window. Pack carries the lifetime trace instead.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Guest hardware absence documented in findings/poc/DF-4975/env.txt (same run). DB poc enum lacks not_testable/skipped; untested is the honest value. Aggravating functional note: after one gpu recovery the mailbox RCV irq stays disabled (late_init never re-runs), silently dropping later FLR notifications.",
  "recommended_fix": "Add cancel_work_sync(&adev->virt.flr_work) to xgpu_ai_mailbox_put_irq() (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff drains flr_work inside the teardown hook before the irq sources are dropped, removing the surviving-work hazard by construction; cannot be build-validated on this guest (no AMD hardware, amdgpu not compiled in).",
  "fix_evidence": "findings/poc/DF-4976/fix.diff"
}