⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1820

amr_pci: UAF - amr_pci_intr runs concurrently with DMA/command teardown in amr_pci_free; interrupt torn down LAST

Summary

amr_pci_free teardown ordering: 484 amr_free(sc) frees command clusters; 487-502 destroy sgtable/ccb DMA tags + bus_dmamem_free; 505-510 bus_dmamem_free mailbox; FINALLY 513-514 bus_teardown_intr+bus_release_resource IRQ. NO lock around steps a-c. NO controller interrupt masking (AMR_SDISABLE_INTR never called; XXX comment at 413). amr_pci_intr INTR_MPSAFE (258) unconditionally calls amr_done(sc). amr_done reads freed mailbox DMA; walks freed amr_busycmd[]; amr_freeslot derefs freed ac->ac_sc. IRQ shared RF_SHAREABLE (258) so handler fires on any device interrupt. Window between amr_free and bus_teardown_intr. kldunload amr during I/O; attach error path with intr live. Fix: bus_teardown_intr FIRST before freeing any DMA; AMR_STATE_SHUTDOWN guard in intr.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1820 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 907 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1820 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/raid/amr/amr_pci.c:477-514. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

amr (AMI MegaRAID) IS in GENERIC. Source: amr_pci_free() tears down DMA tags, command clusters, and mailbox memory BEFORE calling bus_teardown_intr() at L513-514. amr_pci_intr() can fire during teardown and deref freed structures.

Move the bus_teardown_intr/bus_release_resource block to the top of amr_pci_free(), before amr_free(sc) frees commands and DMA tags.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1820/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Move bus_teardown_intr/bus_release_resource to the top of amr_pci_free, before amr_free(sc). Full git-apply-able diff in findings/poc/DF-1820/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/raid/amr/amr_pci.c:477-514. amr IS in GENERIC. amr_pci_free() tears down DMA tags, command clusters, and mailbox memory at L484-510 BEFORE calling bus_teardown_intr() at L513-514. amr_pci_intr() can fire concurrently during teardown and deref freed structures (UAF). No HW attached on audit guest so cannot reproduce at runtime. Fix compile-validated in combined 41-finding build (rc=0, -Werror clean).