⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1911

r600_audio_update_hdmi walks encoder_list without mode_config.mutex: UAF race vs modeset/unload (variant of DF-1878)

Summary

r600_audio_update_hdmi L114-138 list_for_each_entry(encoder,&dev->mode_config.encoder_list,head) NO mutex_lock(&mode_config->mutex). Scheduled via schedule_work(&rdev->audio_work) from IH ISR r600.c:4341/evergreen.c:4900/rs600.c:821. Concurrent modeset drm_mode_config_cleanup (radeon_modeset_fini radeon_display.c:1649) destroys encoders; radeon_afmt_fini radeon_display.c:1564 kfree afmt blocks; radeon_modeset_fini invoked BEFORE radeon_irq_kms_fini radeon_kms.c:74-75; radeon_irq_kms_fini L336-347 flushes only hotplug_work never cancels audio_work. Late audio IRQ queues+runs worker after afmt freed. UAF on encoder+dig->afmt: worker reads/writes dig->afmt->last_buffer_filled_status L291 writes MMIO dig->afmt->offset L254/272/305. Sibling radeon_hotplug_work_func radeon_irq_kms.c:90-93 demonstrates correct pattern mutex_lock. Local user /dev/dri/card0 modeset loop while HDMI audio active -> AZ_FORMAT_WTRIG IH interrupts schedule audio_work race encoder_list mutation. Also unload-path: kldunload radeon afmt freed while queued audio_work runs. Impact: UAF heap corruption -> priv-esc or panic. Fix: mutex_lock(mode_config->mutex) around walk + cancel_work_sync(audio_work/dp_work) in irq_kms_fini.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1911 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 555 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1911 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/drm/radeon/r600_hdmi.c:114-137. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

radeon (loaded as module, no radeon HW in guest). Source: r600_audio_update_hdmi at L114-138 walks dev->mode_config.encoder_list with list_for_each_entry but does NOT hold mode_config.mutex. It is scheduled via schedule_work(&rdev->audio_work) from IH ISR (r600.c:4341, evergreen.c:4900, rs600.c:821). Concurrent modeset del can free an encoder mid-walk → UAF.

Wrap the encoder_list walk with mutex_lock/unlock(&dev->mode_config.mutex).

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1911/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Wrap the encoder_list walk with mutex_lock/unlock(&dev->mode_config.mutex). Full git-apply-able diff in findings/poc/DF-1911/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/drm/radeon/r600_hdmi.c:114-137. radeon (module, no radeon HW in guest). r600_audio_update_hdmi L114-138 walks dev->mode_config.encoder_list with list_for_each_entry but does NOT hold mode_config.mutex. Scheduled via schedule_work(&rdev->audio_work) from IH ISR (r600.c:4341, evergreen.c:4900, rs600.c:821). Concurrent modeset del can free an encoder mid-walk -> UAF. HW gated.