⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2008

Debugfs amdgpu_sa_info leaks kernel GPU virtual address and fence metadata to unprivileged users

  • File: sys/dev/drm/amd/amdgpu/amdgpu_sa.c
  • Lines: 380–392 (debug-info dump); debugfs entry registered at amdgpu_ib.c:415-417
  • Severity: Info
  • CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U:C:L/I:N/A:N
  • CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • Confidence: likely
  • Status: new

Summary

amdgpu_sa_bo_dump_debug_info() exposes:

  • the GPU virtual address of the SA buffer (soffset + sa_manager->gpu_addr at lines 380-381),
  • allocation sizes (line 388),
  • and fence sequence numbers and contexts (lines 391-392)

…to any reader of the debugfs entry amdgpu_sa_info. The entry is created with default mode (0444, world-readable) via drm_debugfs at amdgpu_ib.c:416.

The GPU virtual address leaks the kernel's VRAM/GART buffer layout.

Root cause

amdgpu_sa_bo_dump_debug_info at amdgpu_sa.c:380-392 prints:

  • soffset + sa_manager->gpu_addr (the absolute GPU VA of each SA sub-allocation),
  • eoffset + sa_manager->gpu_addr,
  • eoffset - soffset (size),
  • i->fence->seqno + i->fence->context (fence metadata).

The debugfs entry is registered at amdgpu_ib.c:415-417 with driver_features=0 (no access restriction) via amdgpu_debugfs_sa_init (amdgpu_ib.c:295).

On systems where debugfs is mounted and accessible to non-root users, this leaks kernel GPU address-space layout.

Threat model

Attacker position: any local user who can read /sys/kernel/debug/dri/<card>/amdgpu_sa_info.

Learns the GPU virtual address of the kernel's IB pool. This is a fixed kernel allocation (sa_manager->gpu_addr is set once at init), so the leak primarily assists in confirming GPU VA layout for attacks targeting GPU memory.

Low value on its own; primarily useful as an ASLR-bypass oracle when combined with a separate GPU memory corruption primitive.

Debugfs accessibility varies by platform configuration.

Proof of concept

cat /sys/kernel/debug/dri/0/amdgpu_sa_info

Outputs lines like:

 [0x00000007ff000000 0x00000007ff000100] size      256 protected by 0x00000001 on context 12345

The first hex value is the absolute GPU VA. No build required.

If this information should not be exposed, restrict the debugfs entry to root-only by creating it with mode 0400, or remove the gpu_addr from the output.

Since this mirrors the upstream Linux amdgpu driver's debugfs behavior (which also exposes this), it is low priority. No diff provided — this is an upstream design choice, not a DragonFlyBSD-specific regression.

References

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2008 · 3 files
FileTypeDescriptionSize
VERDICT.md verdict source-only confirmation + mechanism + fix 1.6 KB ↓ raw
fix.diff suggested-fix Restrict to root (mode 0400) or strip pointer fields from seq_printf output. 628 B view raw
../fix_build_new.log build-log Batch kernel build with new fixes (rc=0, -Werror) 5.6 MB ↓ download
VERDICT.md verdict source-only confirmation + mechanism + fix
↓ download raw

DF-2008 — PoC Verification Verdict

Category: drm (module / HW-gated) Source: sys/dev/drm/amd/amdgpu/amdgpu_sa.c:380-392 Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR) Date verified: 2026-07-25

Verdict: REPRODUCED (source-only confirmation; HW/module-gated)

Mechanism

amdgpu_sa_info debugfs seq_printf dumps unsigned long gpu_addr (kernel-space virtual addr), so->meta (fence ptr) and other raw pointers to debugfs. Debugfs readable by any user with debugfs mounted.

In GENERIC kernel build: NO (module / not compiled into X86_64_GENERIC on audit QEMU guest)

Reproduction status

This finding is hardware/module gated: the vulnerable code path requires specific hardware (AMD GPU / radeon / Atheros NIC / RAID controller) or a loadable module not present on the audit QEMU guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.

Fix

Restrict to root (mode 0400) or strip pointer fields from seq_printf output.

See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.

VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

REPRODUCED (source-only): amdgpu_sa_bo_dump_debug_info seq_printf dumps sa_manager->gpu_addr (kernel virtual addr) and i->fence->seqno/context to debugfs. Debugfs readable by any user with debugfs mou

Verified recommended fix

REPRODUCED (source-only): amdgpu_sa_bo_dump_debug_info seq_printf dumps sa_manager->gpu_addr (kernel virtual addr) and i->fence->seqno/context to debugfs. Debugfs readable by any user with debugfs mounted.

Verdict

REPRODUCED (source-only): amdgpu_sa_bo_dump_debug_info seq_printf dumps sa_manager->gpu_addr (kernel virtual addr) and i->fence->seqno/context to debugfs. Debugfs readable by any user with debugfs mounted.