⬢ DragonFlyBSD Kernel Audit
DF-5228 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-5228",
  "title": "dma_free_coherent leaks every physical page (wired forever) and orphans the kernel PTE",
  "file": "sys/dev/drm/linux_dma.c",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "cd findings/poc/DF-5228 && make",
    "run": "kldload drm; kldload ./poc5228.ko; dmesg | grep DF5228",
    "expected": "stock drm.ko: 'kernel PTE STILL VALID (ORPHANED)', 'page STILL WIRED (LEAKED)', alloc+free loop burns ~1MB per MB cycled (deficit 30691 pages for 120MB after reserve exhaustion), control contigmalloc/contigfree deficit 0; patched drm.ko: PTE gone, deficit 2 pages"
  },
  "kernel_refs": [
    "sys/dev/drm/linux_dma.c:81",
    "sys/vm/vm_contig.c:588",
    "sys/vm/vm_contig.c:447",
    "sys/vm/vm_contig.c:531",
    "sys/vm/vm_kern.c:171",
    "sys/vm/vm_kern.c:311",
    "sys/vm/vm_map.c:3325",
    "sys/vm/vm_page.c:2858",
    "sys/dev/drm/radeon/radeon_gart.c:110",
    "sys/dev/drm/amdgpu/amdgpu_ih.c:111"
  ],
  "artifacts": [
    "poc5228.c", "Makefile", "build.sh", "run.sh", "build.log",
    "run.log", "run.fixed.log", "env.txt", "fix.diff",
    "VERDICT.md", "manifest.json", "verdict.json"
  ]
}