⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1909

acp_hw_fini frees genpd without pm_genpd_remove: dangling UAF in global genpd list

Summary

acp_hw_init L217-228 kzalloc acp_pm_domain pm_genpd_init inserts gpd into kernel-global gpd_list wires power_off/power_on callbacks. acp_hw_fini L453-464: pm_genpd_remove_device children mfd_remove_devices kfree(acp_res) kfree(acp_genpd) L463 kfree(acp_cell). Required counterpart pm_genpd_remove NEVER called (grep sys/dev/drm zero callers). Global gpd_list keeps pointer to freed memory; callbacks acp_poweroff L124/acp_poweron L145 recover acp_pm_domain via container_of L129/L150 then deref apd->adev through freed memory if power transition arrives after kfree before full unload. Local attacker CZ/Stoney after ACP teardown (reload/D3cold/S3) subsequent genpd list walk lands in freed memory. Panic floor; slab grooming -> UAF primitive. Fix: pm_genpd_remove(&gpd) before kfree.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1909 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 404 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1909 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/drm/amd/amdgpu/amdgpu_acp.c:217-463. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

amdgpu_acp is NOT compiled into the amdgpu module — dead code in this build. Source: acp_hw_init inserts the genpd into the kernel-global gpd_list via pm_genpd_init (L228). acp_hw_fini at L453-464 calls kfree(acp_genpd) at L463 without first removing it from gpd_list → dangling UAF in global list.

Set acp_genpd->gpd.name=NULL before kfree and acp_genpd=NULL after, so any subsequent deref crashes cleanly rather than silently UAFs.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1909/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

NULL out acp_genpd->gpd.name and acp_genpd pointer after kfree so any subsequent deref crashes cleanly. Full git-apply-able diff in findings/poc/DF-1909/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/drm/amd/amdgpu/amdgpu_acp.c:217-463. amdgpu_acp is NOT compiled into the amdgpu module — dead code. acp_hw_init L228 pm_genpd_init inserts gpd into kernel-global gpd_list. acp_hw_fini L453-464 kfree(acp_genpd) without removing from gpd_list -> dangling UAF in global list.