⬢ DragonFlyBSD Kernel Audit
DF-5018 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5018",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "radeon_mn.c is dead code on DragonFly: excluded from the kernel build (sys/conf/files:2557-2558 commented out), excluded from the radeon KMOD build (sys/dev/drm/radeon/Makefile:107 commented out), and gated behind CONFIG_MMU_NOTIFIER which kconfig.h never defines, so radeon.h:1794-1803 compiles -ENODEV stubs instead. Guest-verified: zero radeon_mn symbols in /boot/kernel/radeon.ko and in the kernel image (evidence.txt). The file additionally cannot compile if re-enabled as-is: its 5-arg blockable invalidate_range_start (radeon_mn.c:121-125), __mmu_notifier_register (radeon_mn.c:227) and mmu_notifier_unregister (radeon_mn.c:90) do not exist in sys/dev/drm/include/linux/mmu_notifier.h or anywhere in the tree. All bo->mn / userptr-invalidation hazards in the radeon driver are therefore unreachable as shipped; the latent hazards documented for posterity (rmn->lock vs reservation-object AB-BA in invalidate_range_start vs unregister paths, the end-=1 empty-range wrap at radeon_mn.c:133, and the missing rmn refcount) only matter if a real mmu_notifier compat layer is ever ported. Info severity; no runtime PoC applicable, hence status untested rather than a runtime verdict.",
  "exploit_chain": "",
  "evidence": "evidence.txt (machine-verified on guest): sys/conf/files:2557-2558 commented; radeon/Makefile:107 commented; grep -c MMU_NOTIFIER kconfig.h = 0; nm radeon.ko and nm kernel contain zero radeon_mn symbols; radeon.h stub block quoted; compat mmu_notifier_ops has no blockable param; __mmu_notifier_register appears only as call sites, never defined.",
  "kernel_refs": [
    "sys/conf/files:2557",
    "sys/dev/drm/radeon/Makefile:107",
    "sys/dev/drm/radeon/radeon.h:1794",
    "sys/dev/drm/radeon/radeon_mn.c:90",
    "sys/dev/drm/radeon/radeon_mn.c:121",
    "sys/dev/drm/radeon/radeon_mn.c:133",
    "sys/dev/drm/radeon/radeon_mn.c:227",
    "sys/dev/drm/include/linux/mmu_notifier.h:40"
  ],
  "poc_changes": "No PoC source (nothing to execute). Evidence collected via a read-only shell script on the audit guest.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "n/a (dead-code verification)",
  "run_cmd": "grep/nm commands in evidence.txt",
  "code_hash": "n/a",
  "notes": "Pass-2 file result: the entire MMU-notifier attack surface of the radeon driver is unreachable. This record exists so later audits do not spend effort on radeon_mn runtime bugs, and to flag the file for deletion or a real port.",
  "recommended_fix": "Delete sys/dev/drm/radeon/radeon_mn.c (matching its build status), or port a real mmu_notifier compat layer first and fix the latent AB-BA lock order, the end-=1 empty-range wrap, and the missing rmn refcount before re-enabling.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "not_applicable: Info-severity dead-code finding, nothing to fix-validate at runtime.",
  "fix_evidence": "evidence.txt documents the dead-build state that constitutes the finding itself."
}