⬢ DragonFlyBSD Kernel Audit
DF-5131 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5131",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static contract defect, mechanically certain: seven call sites (r600.c:2997-2998, cik.c:3695-3696, evergreen_dma.c:130-131, rv770_dma.c:66-67, cik_sdma.c:601-602, radeon_vm.c:705, radeon_vm.c:833) invoke radeon_sync_resv()/radeon_sync_rings() as bare statements and submit + commit GPU work regardless of failure, silently dropping the cross-ring ordering guarantee (silent bo data corruption / racing page-table updates on radeon hardware). Runtime reproduction is impossible on the audit guest (no AMD GPU: pciconf shows zero 1002: devices) and on hardware the observable is a probabilistic stale-data race, matching the Low/hardware-gated family precedent (DF-4871, DF-5089). Verification therefore honestly recorded as untested; the machine-checkable static proof (check_static.sh -> check_static.log: exactly the 7 predicted unfiled bare sites, both known sites, and both correct sites) stands in for a runtime PoC.",
  "exploit_chain": "",
  "evidence": "check_static.log lines BARE cik.c:3695 through BARE radeon_vm.c:833 (7 unfiled sites), CHECKED radeon_ib.c:149 / CHECKED radeon_cs.c:256 (correct pattern), and fix.diff hunks @@ -3692,8 +3692,19 @@ cik.c / @@ -702,7 +702,11 @@ radeon_vm.c showing the canonical rollback fix; VERDICT.md for the full trace incl. the radeon_vm.c:833 r-clobber detail",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_sync.c:89-125",
    "sys/dev/drm/radeon/radeon_sync.c:137-201",
    "sys/dev/drm/radeon/r600.c:2997-2998",
    "sys/dev/drm/radeon/cik.c:3695-3696",
    "sys/dev/drm/radeon/evergreen_dma.c:130-131",
    "sys/dev/drm/radeon/rv770_dma.c:66-67",
    "sys/dev/drm/radeon/cik_sdma.c:601-602",
    "sys/dev/drm/radeon/radeon_vm.c:705",
    "sys/dev/drm/radeon/radeon_vm.c:833"
  ],
  "poc_changes": "no seed PoC existed (filed during pass 2 with untested verdict); authored check_static.sh as the machine-checkable proof since no runtime trigger is possible without radeon hardware",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (guest up, zero AMD/ATI PCI devices)",
  "runtime_sec": 2,
  "guest_dirty": 0,
  "build_cmd": "none (static): sh findings/poc/DF-5131/check_static.sh /home/maxx/dfbsd/dfbsd",
  "run_cmd": "sh findings/poc/DF-5131/check_static.sh /home/maxx/dfbsd/dfbsd",
  "code_hash": "81340ef70071e0b4cea7b5fd49cd730cfce9ef583f2674d27810e63336d350f2",
  "notes": "Pass-2 synthesis of the DF-4871 family from the sync-engine side: complete enumeration of every radeon_sync_* caller in the tree. Related-but-distinct negative results in the file-level notes: (1) r600/rv770/evergreen/cik_sdma/cik copy paths also under-allocate dest-ring dwords for the up-to-4 semaphore waits sync_rings may emit (e.g. r600_dma.c:458 allocates num_loops*4+8, no RADEON_NUM_SYNCS*8 term) - over-emission only DRM_ERRORs and writes masked-in-bounds (radeon.h:2710-2716), so GPU command-stream corruption risk, upstream parity, not filed separately; (2) the count-full fallback path skips radeon_fence_note_sync (radeon_sync.c:158-164), correctness wart only.",
  "recommended_fix": "Check both sync returns at all 7 sites with the radeon_ib_schedule-style rollback (radeon_ring_unlock_undo + radeon_sync_free + ERR_PTR for copy paths; propagate r at the two radeon_vm.c sites, un-clobbering r at :833) - see fix.diff",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix validation not applicable: no runtime baseline can exist on the QEMU audit guest (no AMD GPU) and the defects observable is a probabilistic hardware ordering race; fix.diff was verified to apply cleanly (git apply --check) to the unmodified tree and mirrors the already-correct radeon_ib.c:149-155 pattern",
  "fix_evidence": "git apply --check findings/poc/DF-5131/fix.diff => clean; diff hunks at cik.c @@ -3692,8 +3692,19 @@, radeon_vm.c @@ -702,7 +702,11 @@ and @@ -830,7 +834,9 @@"
}