⬢ DragonFlyBSD Kernel Audit
DF-5181 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-5181",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "smu9_send_msg_to_smc (smu9_smumgr.c:101-117) and smu9_send_msg_to_smc_with_parameter (:128-147) detect SMC failure (ret != 1 from the bounded smu9_wait_for_response) but unconditionally return 0 at :116/:146, so every in-tree caller guard is vacuous (vega10_smumgr.c:147-150 PP_ASSERT_WITH_CODE(!send) can never fire; vega12_smumgr.c:52-57 tests ==0 as success) and smu9_get_argument() (:150-155) serves stale C2PMSG_82 content into version/feature/table logic (vega10_smumgr.c:151,160 / :107-108->:113-123 / :47-58). No memory-unsafe sink: table memcpy sizes are driver-fixed (vega10_smumgr.c:45-46,57-58); waits are bounded (smu_helper.c:161-172, usec_timeout=200ms hwmgr.c:85). Phase V skipped per contract (Low, hardware-fault-gated, vendored parity with upstream Linux which carries the identical defect).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5181/VERDICT.md (caller-side vacuous-guard proof with pp_debug.h:37-43 polarity); README.md; fix.diff. Decisive lines: smu9_smumgr.c:113-116 and :143-146 (log-then-return-0), vega10_smumgr.c:147-151, vega12_smumgr.c:52-57.",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/smu9_smumgr.c:112",
    "sys/dev/drm/amd/powerplay/smumgr/smu9_smumgr.c:116",
    "sys/dev/drm/amd/powerplay/smumgr/smu9_smumgr.c:142",
    "sys/dev/drm/amd/powerplay/smumgr/smu9_smumgr.c:146",
    "sys/dev/drm/amd/powerplay/smumgr/smu9_smumgr.c:150",
    "sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:47",
    "sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:107",
    "sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:147",
    "sys/dev/drm/amd/powerplay/smumgr/vega12_smumgr.c:52",
    "sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:161",
    "sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:85"
  ],
  "poc_changes": "No PoC authored: finding is a source-semantics defect (unconditional return 0) fully demonstrated by citation; guest lacks AMD Vega silicon so no runtime PoC is possible.",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Phase V skipped per reviewer contract (Low severity / hardening-class, hardware-gated trigger). QEMU guest has no Vega10/12 dGPU, so amdgpu smu9 powerplay cannot instantiate; status recorded honestly as untested rather than not_reproduced (no run attempted). Upstream-parity defect: file is a verbatim port of Linux smu9_smumgr.c; upstream is the fix owner, DF can carry the two-line fix independently. Pass-2 context: last smumgr file; DF-4774 (smu7 fw-upload OOB) and DF-5056 (smu10 dangling smu_backend) are different files/classes and do not apply to smu9.",
  "recommended_fix": "Propagate SMC failure: return (ret == 1) ? 0 : -EIO; in both smu9_send_msg_to_smc and smu9_send_msg_to_smc_with_parameter (caller-compatible; vega10/vega12 guards already expect 0 == success).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (two return-value changes + comments) against the read-only sys/ tree. Baseline/patched runtime comparison impossible on the audit guest (no Vega silicon); caller compatibility verified by inspection: all in-tree call sites treat 0 as success (vega10_smumgr.c:147, vega12_smumgr.c:52-57, function tables vega10_smumgr.c:353-354 / vega12_smumgr.c:372-373).",
  "fix_evidence": "findings/poc/DF-5181/fix.diff (git-apply-able unified diff, generated via diff -u from the pristine file; hunk headers @@ -113,7 and @@ -143,7 match the audited tree)."
}