⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1953

Unmasked ioread32(vaddr+head+4) reads 4 bytes past ring-buffer mapping in semaphore_waits_for

Summary

semaphore_waits_for L99-122: backwards-scan loop masks head with (ring->size-1) before each ioread32 L109; post-loop *seqno=ioread32(vaddr+head+4)+1 L122 does NOT mask (head+4). When matched MI_SEMAPHORE_MBOX at ring offset (size-4) head=size-4 head+4=size -> ioread32 reads 4 bytes at byte offset [size,size+3] past end of vmap GEM ring buffer. ring->size power-of-2 GEM object mapped exactly size bytes intel_ringbuffer.c:1099. ioread32=volatile u32* deref io.h:91 faults on unmapped next page -> kernel panic local DoS; or reads adjacent kernel memory as seqno operand. Reachable Gen6/7 only IS_GEN(dev_priv,6,7)&&RING_WAIT_SEMAPHORE L255. Attacker submits MI_SEMAPHORE_MBOX wait at ring offset (size-4) waiting on never-signaled seqno; hangcheck timer fires scan matches dereferences past mapping. Fix: ioread32(vaddr+((head+4)&(size-1))) mirror in-loop mask.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1953 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 405 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1953 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/drm/i915/intel_hangcheck.c:103-122. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

i915 (not in GENERIC, no Intel GFX HW in guest). Source: semaphore_waits_for at L99-122 backwards-scan loop masks head with (ring->size-1) before each ioread32 at L109; post-loop *seqno=ioread32(vaddr+head+4)+1 at L122 does NOT mask (head+4). When matched MI_SEMAPHORE_MBOX at ring offset (size-4): head=size-4, head+4=size, reads 4 bytes past ring-buffer mapping.

Apply the same & (engine->buffer->size - 1) mask to (head+4) before ioread32.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1953/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Apply the same & (engine->buffer->size - 1) mask to (head+4) before ioread32. Full git-apply-able diff in findings/poc/DF-1953/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/drm/i915/intel_hangcheck.c:103-122. i915 (not in GENERIC, no Intel GFX HW in guest). semaphore_waits_for L99-122 backwards-scan loop masks head with (ring->size-1) before each ioread32 L109; post-loop *seqno=ioread32(vaddr+head+4)+1 L122 does NOT mask (head+4). When matched MI_SEMAPHORE_MBOX at ring offset (size-4): head=size-4, head+4=size, reads 4 bytes past ring-buffer mapping. HW gated.