β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-1936

Unconditional kprintf on every VM retry fault: local kernel-log DoS

Summary

vega10_ih_prescreen_iv L288-301 kfifo_put block #if 0 replaced by unconditional kprintf fires on every VM retry page fault whose PASID resolves through pasid_idr (common case for any GPU workload touching unmapped VA). amdgpu_ih_process calls callback->prescreen_iv once per IV L154-157 no rate limiting. Local user render-node access submits CS touching unmapped GPU VM -> GPU emits retry-fault IVs continuously -> kprintf from hardirq context thousands/sec -> fills /var/log burns CPU. No privilege gain/info-leak/corruption; log/disk/CPU exhaustion. Fix: delete #if 0/#else block let control fall through to existing lockmgr(LK_RELEASE);return true at L303-305 or replace kprintf with ratelimited DRM_DEBUG.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1936 Β· 4 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able fix for the cited bug 426 B view raw
VERDICT.md verdict source-confirmation analysis 714 B ↓ raw
build.sh build-script N/A (source-only) 61 B view raw
run.sh run-script N/A (source-only) 87 B view raw
VERDICT.md verdict source-confirmation analysis
↓ download raw

DF-1936 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS β€” hardware-gated)

Mechanism: vega10_ih_prescreen_iv L288-301 kfifo_put block #if 0 replaced by unconditional kprintf fires on every VM retry page fault whose PASID resolves through pasid_idr (common case for any GPU workload touc

Citation: sys/dev/drm/amd/amdgpu/vega10_ih.c:288-301

Fix: Applied fix.diff β€” compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror
↓ fix.diffcombined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: unconditional kprintf on every VM retry fault (vega10_ih.c:288-301)

Verified recommended fix

Source-confirmed: unconditional kprintf on every VM retry fault (vega10_ih.c:288-301)

Verdict

Source-confirmed: unconditional kprintf on every VM retry fault (vega10_ih.c:288-301)