⬢ DragonFlyBSD Kernel Audit
DF-5078 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-5078",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Reproduced at logic level with a verbatim userland replica of the FULL dce120 irq table (irq_service_dce120.c:87-263 entry macros incl. the SRI/IRQ_REG_ENTRY forms, dce120 hpd_ack :40-65, funcs tables :67-85), to_dal_irq_source_dce110 (dce110:315-393, the converter dce120 installs at :266), dce110_vblank_set (dce110:195-219) and the generic dispatch (irq_service.c:77-158), run on the audit guest. Designators cover exactly 0..83 while the shared enum runs to DAL_IRQ_SOURCES_NUMBER=90: DC_IRQ_SOURCE_DC{1..6}_VLINE0 (84..89) stay zero-initialized with .funcs==NULL, and find_irq_source_info (irq_service.c:82) bounds-checks only the index, so dal_irq_service_ack (:152, called first by dal_irq_service_set at :116) and dal_irq_service_set (:118) dereference info->funcs->ack/.set on NULL \u2014 replica ack(84) child dies signal 11 at the deref and set(84) in the main process SIGSEGVs deterministically (exit 139, both runs), the kernel-equivalent being a page-0 read at ~offsetof(.funcs->ack) => hard panic. This is the DF-2168/DF-4713/DF-4932/DF-4995/DF-5054 NULL-funcs-dispatch family instance on the DCE120 (Vega10/12) table \u2014 the shape noted for maintainers in DF-4932s verdict; each asic table is its own code. Reachability is latent and traced honestly: every in-tree dc_interrupt_set/ack caller was checked (dm_irq_state PFLIP/VBLANK+otg_inst hardware-bounded 0..5 per amdgpu_dm_irq.c:535-556; hpd_init/fini HPD/HPDRX per amdgpu_dm_irq.c:625-645 and :515-527; amdgpu_dm.c:3014 VBLANK+otg_inst; the IH path amdgpu_dm_irq.c:477-487 can only receive to_dal-mapped covered sources or INVALID \u2014 the harness to_dal walk (256x13 combos incl. 0xdead) returns 0 results in 84..89), and the service is created only on DCE12 hardware (dce120_resource.c:1011) while the guest has no AMD GPU (0 PCI 1002: devices). No unprivileged trigger exists today; the panic is one future caller away (a DM change using VLINE0 on DCE12, or the DAL_VALID_IRQ_SRC_NUM off-by-one at irq_types.h:157-158 admitting src==90 into any caller gating on it). No write primitive, no leak; ceiling is a kernel NULL-page-read panic (local DoS). FIX VALIDATED: fix.diff (six VLINE0 dummy_irq_entry() designators completing the table, the DF-4932/DF-4995/DF-5054 per-asic shape) applied to guest /usr/src together with DF-5079s (hunk at :260); full amdgpu.ko module rebuild under -Werror rc=0, zero errors, zero warnings, irq_service_dce120.o recompiled and linked (amdgpu_module_build.log:574); replica fixed mode handles VLINE0 via dummy log-and-return handlers, exit 0 vs baseline 139; guest sources reverted md5-verified pristine (51bd6ea8...), make clean, guest returned to clean snapshot.",
  "exploit_chain": "",
  "evidence": "run.log + run.2.log (deterministic x2: 6 NULL-funcs slots 84..89; controls pass incl. VBLANK1..6 arming pipes 0..5 and to_dal sweep 0 hits in 84..89; child ack(84) signal 11; main set(84) Segmentation fault exit=139; fixed mode exit=0); dmesg.txt (kernel-observed signal-11 exits of the replica); dce120_vline0gap.c header (path:line map); amdgpu_module_build.log (777 lines, rc=0, 0 error:/0 warning:, irq_service_dce120.o at :573-574)",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:177",
    "sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:263",
    "sys/dev/drm/amd/display/dc/irq/irq_service.c:82",
    "sys/dev/drm/amd/display/dc/irq/irq_service.c:116",
    "sys/dev/drm/amd/display/dc/irq/irq_service.c:118",
    "sys/dev/drm/amd/display/dc/irq/irq_service.c:152",
    "sys/dev/drm/amd/display/dc/irq_types.h:140",
    "sys/dev/drm/amd/display/dc/irq_types.h:147",
    "sys/dev/drm/amd/display/dc/irq_types.h:157",
    "sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:1011"
  ],
  "poc_changes": "Self-authored from the family template (DF-5055s harness skeleton): instantiated the FULL dce120 designator set (not just the defect region) with the dce120 SRI/IRQ_REG_ENTRY macro forms (SRI collapsed to straight mm<block><id>_<reg> fake register numbers; per-instance mask defines generated to satisfy the block##reg_num token-paste), dce120 hpd_ack verbatim with a fake register file, plus fork-based ack-path trigger and a main-process set-path trigger, static NULL-funcs audit, and 256x13 to_dal sweep.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "sh /root/df5078/build.sh   # cc -O2 -Wall -std=gnu11 [-DFIX_DF5078] -o dce120_vline0gap_{base,fixed} (rc=0)",
  "run_cmd": "sh /root/df5078/run.sh     # baseline: exit=139 x2; fixed: exit=0 x2",
  "code_hash": "d196028e0b96dcd658ff62b219553a6949c41364019b13cf6c7533d4676a5c77",
  "notes": "Fix validation shared one amdgpu.ko rebuild with DF-5079 (DF-4932+DF-4933 precedent). dce120 hpd_ack verified byte-equivalent in behavior to dce110s audited copy; designators verified complete and in-range over 0..83 (arithmetic: 1+6+6+6+6+1+6+1+31+6+1+1+6+6). vblank .src_id arithmetic (19..24 consecutive per ivsrcid_vislands30.h:66-156) verified correct \u2014 the reachable vblank path is healthy. Guest reset to clean snapshot after the run set (guest_dirty=0).",
  "recommended_fix": "Complete the dce120 table over the shared enum: six [DC_IRQ_SOURCE_DCx_VLINE0] = dummy_irq_entry() designators (fix.diff); hub-level hardening (funcs NULL guards in irq_service.c set/ack) tracked by DF-4932.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": true,
  "fix_verdict": "fix.diff applied to guest /usr/src (patch -V none -p1, hunk #1 at :260); full make -j6 amdgpu.ko rebuild rc=0 with 0 errors/0 warnings under -Werror (amdgpu_module_build.log; irq_service_dce120.c compiled at :573-574); replica fixed mode (identical shape) exits 0 where baseline exits 139; sources reverted md5-verified pristine (51bd6ea8...), make clean.",
  "fix_evidence": "fix_build.log (=amdgpu_module_build.log, rc=0, zero diagnostics); fix_run.log (fixed mode: 0 NULL-funcs slots, dummy ack/set log-and-return, exit 0); run.log (baseline exit=139)",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul  2 06:02:54 UTC 2026 (amdgpu.ko module rebuilt with fix; not booted \u2014 no AMD GPU on guest)"
}