⬢ DragonFlyBSD Kernel Audit
DF-5144 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-5144",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info hardening finding from the pass-2 audit of dc_surface.c: dc_plane_get_status() (dc_surface.c:98-129) is dead code in this tree (declared dc.h:563, zero callers) but carries three latent defects — unchecked core_dc->res_pool deref at dc_surface.c:118, lockless iteration over dc->current_state (swapped/freed at dc.c:1026-1030 with no internal lock) at :118-126, and an unchecked hwss.update_pending_status call at :125. No impact as shipped; next vendor sync that ports the upstream amdgpu_dm caller would make these reachable (UAF-read/NULL-deref class). Phase V skipped per contract (Info severity); no PoC built, no guest run.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5144/README.md (analysis + static reproduce commands); findings/poc/DF-5144/VERDICT.md (full narrative incl. destruct()-pairing and refcount negative results and the recommended diff)",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/core/dc_surface.c:105",
    "sys/dev/drm/amd/display/dc/core/dc_surface.c:115",
    "sys/dev/drm/amd/display/dc/core/dc_surface.c:118",
    "sys/dev/drm/amd/display/dc/core/dc_surface.c:125",
    "sys/dev/drm/amd/display/dc/core/dc.c:1026",
    "sys/dev/drm/amd/display/dc/dc.h:563"
  ],
  "poc_changes": "No PoC — the function has no callers in this tree, so no trigger exists to build; Phase V skipped for Info severity per contract.",
  "attempts": 0,
  "guest_uname": "n/a (no guest run — Info severity, Phase V skipped per contract)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (no PoC built)",
  "run_cmd": "n/a (no PoC run)",
  "code_hash": "sha256:4b31ec02936aa8495470bc7e9cc38892334c89c821436d7f10f7883c26a9e8f6 (VERDICT.md)",
  "notes": "Also recorded as negative results: destruct() gamma/tf release-then-NULL pairing is correct in-tree (incl. amdgpu_dm.c:2454-2458 error path); dc_gamma_release(**) vs dc_transfer_func_release(*) API asymmetry is a trap but not a bug today; enable_surface_flip_reporting (:64-69) is dead with unchecked irq-source enum arithmetic; kref overflow not attacker-reachable (refcount_inc saturates only at <=0, needs 2^31 simultaneous retains).",
  "recommended_fix": "In dc_plane_get_status(): NULL-check core_dc->res_pool, take dc_retain_state()/dc_release_state() around the current_state iteration, and NULL-check hwss.update_pending_status (see VERDICT.md diff).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix validation not performed: Info-severity hardening finding on dead code; Phase V skipped per contract.",
  "fix_evidence": "n/a"
}