⬢ DragonFlyBSD Kernel Audit
DF-5193 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5193",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code-level defect confirmed (clear-before-validate in drm_legacy_sg_free orphans the sg allocation on a handle mismatch and permits a second SG_ALLOC on top of the leak), but it is unreachable in this tree and on this guest: the SG ioctls are DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY (capable(CAP_SYS_ADMIN) enforced at drm_ioctl.c:538), and no in-tree driver sets DRIVER_SG or DRIVER_LEGACY, so both handlers return -EOPNOTSUPP at drm_scatter.c:69-73/:125-129 even for root; the QEMU guest additionally has no DRM device nodes at all (run.log). Double-latent; filed Info for the record with a fix.diff, consistent with the drm-family latent findings (DF-5187/DF-5188/DF-5190).",
  "exploit_chain": "",
  "evidence": "run.log (open of every DRM node -> ENOENT; kldstat shows no drm modules); VERDICT.md (privilege + feature gate citations, plus the negative kill-list: no busaddr-size overflow possible, size-0 wrap benign, dev->sg lifecycle fully serialized under drm_global_mutex so no double-free race)",
  "kernel_refs": [
    "sys/dev/drm/drm_scatter.c:131",
    "sys/dev/drm/drm_scatter.c:134",
    "sys/dev/drm/drm_ioctl.c:636",
    "sys/dev/drm/drm_ioctl.c:538",
    "sys/dev/drm/drm_ioctl.c:866",
    "sys/dev/drm/include/drm/drm_drv.h:677",
    "sys/dev/drm/i915/i915_drv.c:3284",
    "sys/dev/drm/radeon/radeon_drv.c:671",
    "sys/dev/drm/drm_file.c:550"
  ],
  "poc_changes": "n/a (finding originated in this run)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o drm_sg_probe drm_sg_probe.c",
  "run_cmd": "./drm_sg_probe; kldstat; ls -l /dev/dri /dev/drm",
  "code_hash": "e76eb9fdaf9ed5af2a9b2e8ddc53bab5935cb0f01dbaada3f0dc46465c89690b",
  "notes": "Dead-code corner semantics verified for the negative list: kmalloc(0) returns ZERO_LENGTH_PTR (kern_slaballoc.c:888-891), pages*sizeof(busaddr) cannot overflow 64 bits (pages <= 2^52), and the entire dev->sg lifecycle (SG_ALLOC/SG_FREE ioctls + lastclose teardown) is serialized under drm_global_mutex for DRIVER_LEGACY drivers (drm_ioctl.c:866-872, drm_file.c:436-453), killing the hypothesized concurrent-free race.",
  "recommended_fix": "drm_legacy_sg_free: take DRM_LOCK, validate entry && entry->vaddr == request->handle before clearing dev->sg, and only then NULL it and clean up.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "No baseline exists to validate against (no DRIVER_SG driver in the tree, no DRM device on the guest). fix.diff authored for the day the path revives (it mirrors upstream Linux ordering discipline).",
  "fix_evidence": "fix.diff"
}