⬢ DragonFlyBSD Kernel Audit
DF-4980 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-4980",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "amdgpu_atomfirmware_allocate_fb_scratch() sizes kzalloc(GFP_KERNEL) from the untrusted VBIOS field used_by_driver_in_kb (up to 64 MB, unclamped) and its -ENOMEM return is ignored by the only caller (amdgpu_atombios.c:2046; legacy twin :2049), leaving consumers that dereference atom_context->scratch without any NULL guard (atombios_dp.c:74-76 write to scratch+1, atombios_i2c.c:54/104). On Linux-semantics allocators that failure is a NULL-page write panic; on DragonFly GFP_KERNEL maps to M_WAITOK without M_NULLOK (gfp.h:40) so kzalloc can never return NULL and the !ctx->scratch branch (amdgpu_atomfirmware.c:107) is dead code \u2014 failure instead surfaces as the allocators own panic under kernel-map exhaustion with a VBIOS-influenced 64 MB request. Info/defense-in-depth: no demonstrated unprivileged impact on DF; unfixed upstream (master amdgpu_atombios.c:1935 still ignores the return).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4980/VERDICT.md (line-proven chain) + README.md; decisive lines: amdgpu_atomfirmware.c:99,106-108; amdgpu_atombios.c:2046,2049; atombios_dp.c:74-76; atombios_i2c.c:54,104; gfp.h:40; slab.h:35; kern_slaballoc.c:1721-1727",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_atomfirmware.c:99",
    "sys/dev/drm/amd/amdgpu/amdgpu_atomfirmware.c:106",
    "sys/dev/drm/amd/amdgpu/amdgpu_atomfirmware.c:107",
    "sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:2046",
    "sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:2049",
    "sys/dev/drm/amd/amdgpu/atombios_dp.c:74",
    "sys/dev/drm/amd/amdgpu/atombios_i2c.c:104",
    "sys/dev/drm/include/linux/gfp.h:40",
    "sys/kern/kern_slaballoc.c:1723"
  ],
  "poc_changes": "n/a \u2014 analysis-only evidence pack; no PoC built (guest has no AMD GPU; the defective branch is provably dead on DF because GFP_KERNEL == M_WAITOK without M_NULLOK)",
  "attempts": 0,
  "guest_uname": "not-booted (Info finding; no AMD GPU on guest, Phase V not applicable)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding on the class DF-2027 does NOT cover (untrusted-size allocation + ignored error, not offset deref). File is byte-identical to Linux v5.0 (verified by diff); upstream master still ignores the return. Legacy twin at amdgpu_atombios.c:1781 is the reachable instance on dce8/10/11 ASICs.",
  "recommended_fix": "Clamp the untrusted usage_bytes to the drivers own 20 KB default and check the return value of both allocate_fb_scratch variants in amdgpu_atombios_init()",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not applicable: Info-grade finding with no reproducible impact on the verification guest (no AMD GPU; DF allocator semantics make the NULL branch dead). fix.diff is error-propagation + untrusted-size clamping authored from line-accurate source reading, never applied to sys/.",
  "fix_evidence": "findings/poc/DF-4980/fix.diff"
}