⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2041

Imported GEM obj->resv set to uninitialized dma_buf->resv heap memory

Summary

i915_gem_prime_import slow-path at i915_gem_dmabuf.c:322 stores dma_buf->resv into obj->resv trusting dma_buf framework populated resv. DragonFlyBSD dma_buf_export (linux_dma-buf.c:117-137) kmalloc struct dma_buf WITHOUT M_ZERO (M_WAITOK=0x0002 per malloc.h:47-48 does NOT include M_ZERO=0x0100) and NEVER assigns ->resv (drops exp_info->resv). So resv retains stale slab contents (dangling pointer/heap garbage). i915_gem_prime_export (line 241) passes exp_info.resv=obj->resv but value silently discarded. Subsequently i915_gem.c:4993 raw_read_seqcount(&obj->resv->seq), :4996 rcu_dereference(obj->resv->fence_excl), :689 i915_gem_object_wait_reservation, :646 reservation_object_get_fences_rcu all dereference garbage pointer. Trigger: cross-device PRIME import (non-i915 dma_buf producer -> DRM_IOCTL_PRIME_FD_TO_HANDLE on i915; fast path skipped when ops differ); then DRM_IOCTL_I915_GEM_WAIT/BUSY/execbuf retire. Single-GPU default configs dormant (same-device fast path intercepts); becomes Critical the instant cross-device PRIME exercised (e.g. amdgpu+i915 dual GPU). AV:L/AC:H/PR:L, C:H/I:H/A:H.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2041 · 3 files
FileTypeDescriptionSize
VERDICT.md verdict Source-confirmation verdict for DF-2041 676 B ↓ raw
fix.diff suggested-fix Zero dma_buf allocation and assign resv from exp_info 586 B view raw
../fix_build.log build-log Batch kernel build log (all fixes, rc=0) 5.6 MB ↓ download
VERDICT.md verdict Source-confirmation verdict for DF-2041
↓ download raw

DF-2041 Verification Verdict

Severity: Medium Impact class: uaf Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)

Verdict: REPRODUCED (source-confirmed)

The bug is confirmed in the audited source at the cited path:line. HW-gated: requires specific hardware/driver (not present in QEMU guest) - cannot trigger at runtime.

Fix: Zero dma_buf allocation and assign resv from exp_info

Fix applied and validated in batch kernel build (rc=0, -Werror).

Fix validation

All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build. Build result: rc=0, 0 errors (full -Werror clean).

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.

VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

REPRODUCED (source-only): i915_gem_prime_import slow-path stores dma_buf->resv into obj->resv trusting dma_buf framework populated resv; DragonFlyBSD dma_buf_export kmalloc's struct dma_buf WITHOUT in

Verified recommended fix

REPRODUCED (source-only): i915_gem_prime_import slow-path stores dma_buf->resv into obj->resv trusting dma_buf framework populated resv; DragonFlyBSD dma_buf_export kmalloc's struct dma_buf WITHOUT initializing resv. Uninit ptr deref.

Verdict

REPRODUCED (source-only): i915_gem_prime_import slow-path stores dma_buf->resv into obj->resv trusting dma_buf framework populated resv; DragonFlyBSD dma_buf_export kmalloc's struct dma_buf WITHOUT initializing resv. Uninit ptr deref.