Summary

vega10_ih_prescreen_iv L288-301 kfifo_put block #if 0 replaced by unconditional kprintf fires on every VM retry page fault whose PASID resolves through pasid_idr (common case for any GPU workload touching unmapped VA). amdgpu_ih_process calls callback->prescreen_iv once per IV L154-157 no rate limiting. Local user render-node access submits CS touching unmapped GPU VM -> GPU emits retry-fault IVs continuously -> kprintf from hardirq context thousands/sec -> fills /var/log burns CPU. No privilege gain/info-leak/corruption; log/disk/CPU exhaustion. Fix: delete #if 0/#else block let control fall through to existing lockmgr(LK_RELEASE);return true at L303-305 or replace kprintf with ratelimited DRM_DEBUG. [PASS-2 NOTES: DF-2589 duplicates the sinf half of DF-2386; DF-2590 same class in hkey_event - fold on triage; DF-1936 (kprintf log spam) actually lives at vega10_ih.c:288-301 not this file]

PoC verification

Evidence pack

findings/poc/DF-1936 · 4 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited bug	426 B	view raw
VERDICT.md	verdict	source-confirmation analysis	1.0 KB	↓ raw
build.sh	build-script	N/A (source-only)	65 B	view raw
run.sh	run-script	N/A (source-only)	89 B	view raw

VERDICT.md verdict source-confirmation analysis

↓ download raw

DF-1936 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: vega10_ih_prescreen_iv L288-301 kfifo_put block #if 0 replaced by unconditional kprintf fires on every VM retry page fault whose PASID resolves through pasid_idr (common case for any GPU workload touc

Citation: sys/dev/drm/amd/amdgpu/vega10_ih.c:288-301

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: unconditional kprintf on every VM retry fault (vega10_ih.c:288-301)

Verified recommended fix

Source-confirmed: unconditional kprintf on every VM retry fault (vega10_ih.c:288-301)

Verdict