Unconditional kprintf on every VM retry fault: local kernel-log DoS
Summary
vega10_ih_prescreen_iv L288-301 kfifo_put block #if 0 replaced by unconditional kprintf fires on every VM retry page fault whose PASID resolves through pasid_idr (common case for any GPU workload touching unmapped VA). amdgpu_ih_process calls callback->prescreen_iv once per IV L154-157 no rate limiting. Local user render-node access submits CS touching unmapped GPU VM -> GPU emits retry-fault IVs continuously -> kprintf from hardirq context thousands/sec -> fills /var/log burns CPU. No privilege gain/info-leak/corruption; log/disk/CPU exhaustion. Fix: delete #if 0/#else block let control fall through to existing lockmgr(LK_RELEASE);return true at L303-305 or replace kprintf with ratelimited DRM_DEBUG.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1936 Β· 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 426 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 714 B | β raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1936 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS β hardware-gated)
Mechanism: vega10_ih_prescreen_iv L288-301 kfifo_put block #if 0 replaced by unconditional kprintf fires on every VM retry page fault whose PASID resolves through pasid_idr (common case for any GPU workload touc
Citation: sys/dev/drm/amd/amdgpu/vega10_ih.c:288-301
Fix: Applied fix.diff β compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
β
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: unconditional kprintf on every VM retry fault (vega10_ih.c:288-301)
Verified recommended fix
Source-confirmed: unconditional kprintf on every VM retry fault (vega10_ih.c:288-301)
Verdict
Source-confirmed: unconditional kprintf on every VM retry fault (vega10_ih.c:288-301)
No comments yet.