⬢ DragonFlyBSD Kernel Audit
DF-5227 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-5227",
  "title": "dma_alloc_coherent returns non-zeroed (stale) kernel memory",
  "file": "sys/dev/drm/linux_dma.c",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "cd findings/poc/DF-5227 && make",
    "run": "kldload drm; kldload ./poc5227.ko; dmesg | grep DF5227",
    "expected": "stock drm.ko: marker_hits=512 stale_nonzero_pages=512/512 + hexdump of the marker inside the coherent allocation; patched drm.ko: marker_hits=0 stale_nonzero_pages=0/512"
  },
  "kernel_refs": [
    "sys/dev/drm/linux_dma.c:47",
    "sys/dev/drm/linux_dma.c:64",
    "sys/vm/vm_contig.c:608",
    "sys/vm/vm_contig.c:612",
    "sys/vm/vm_contig.c:533",
    "sys/vm/vm_contig.c:288",
    "sys/dev/drm/amdgpu/amdgpu_ih.c:66",
    "sys/dev/drm/drm_pci.c:130",
    "sys/dev/drm/radeon/radeon_gart.c:85"
  ],
  "artifacts": [
    "poc5227.c", "Makefile", "build.sh", "run.sh", "build.log",
    "run.log", "run.fixed.log", "env.txt", "fix.diff",
    "VERDICT.md", "manifest.json", "verdict.json"
  ]
}