Summary

r600_dma.c L459 radeon_ring_lock(rdev,ring,num_loops*4+8). radeon_sync_rings radeon_sync.c:137-201 emits up to RADEON_NUM_SYNCS=4 semaphore_wait 3 dwords each=12 on destination ring. r600_dma_fence_ring_emit L285-298 writes 4 dwords. Worst-case overhead 16 dwords reservation covers only 8 -> deficit 8. radeon_ring_write radeon.h:2710 tests count_dw<=0 DRM_ERROR then unconditionally writes ring->ring[wptr++] ptr_mask wraps overwriting earlier unconsumed commands. GPU ring corruption -> lockup/hang/spurious DMA. ptr_mask prevents kernel-heap OOB. Admin-gated radeon_testing/benchmark tunable required same caveat as DF-1942. evergreen_dma.c:123 same pattern num_loops*5+11 also undersized. Fix: num_loops*4+RADEON_NUM_SYNCS*3+8.

PoC verification

Evidence pack

findings/poc/DF-1943 · 4 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited bug	486 B	view raw
VERDICT.md	verdict	source-confirmation analysis	1.0 KB	↓ raw
build.sh	build-script	N/A (source-only)	65 B	view raw
run.sh	run-script	N/A (source-only)	89 B	view raw

VERDICT.md verdict source-confirmation analysis

↓ download raw

DF-1943 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: r600_dma.c L459 radeon_ring_lock(rdev,ring,num_loops*4+8). radeon_sync_rings radeon_sync.c:137-201 emits up to RADEON_NUM_SYNCS=4 semaphore_wait 3 dwords each=12 on destination ring. r600_dma_fence_ri

Citation: sys/dev/drm/radeon/r600_dma.c:459-483

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: ring_lock under-reserves dwords for sync semaphore (r600_dma.c:459-483)

Verified recommended fix

Source-confirmed: ring_lock under-reserves dwords for sync semaphore (r600_dma.c:459-483)

Verdict