DF-4265 — amdgpu_cs_wait_all_fences reads fence->error after the final dma_fence_put (UAF read)

File: sys/dev/drm/amd/amdgpu/amdgpu_cs.c (pass 2) Severity: Low (use-after-free read; value returned as ioctl errno) — CWE-416 Confidence: likely (defect certain; runtime manifestation narrowed by RCU-deferred freeing on this tree)

Build

cc -O2 -Wall -o wait_all_fences_uaf wait_all_fences_uaf.c

Run (as any user on amdgpu hardware)

./wait_all_fences_uaf

Submits 33 minimal GFX CS on one context (so the context fence slot for seq 1 — replaced only after amdgpu_sched_jobs=32 further submissions, amdgpu_ctx.c:449-461 — is recycled while the wait ioctl holds its own reference), then calls DRM_IOCTL_AMDGPU_WAIT_FENCES with wait_all=1 on seq 1.

Root cause (path:line)

amdgpu_cs_wait_all_fences() (amdgpu_cs.c:1481-1516):

r = dma_fence_wait_timeout(fence, true, timeout);
dma_fence_put(fence);              /* :1501  may drop the LAST ref   */
if (r < 0) return r;
if (r == 0) break;
if (fence->error)                  /* :1508  READ AFTER PUT          */
        return fence->error;

If the reference obtained from amdgpu_cs_get_fence() (amdgpu_ctx.c:489) is the last one (context slot replaced, scheduler/job refs dropped), :1501 frees the fence and :1508 reads freed memory. Compare the correct ordering in the sibling amdgpu_cs_wait_ioctl() (:1367-1370: read fence->error before the put).

On this tree the free is deferred: drm_sched_fence_release_finished → dma_fence_put(scheduled) → drm_sched_fence_release_scheduled → call_rcu(&fence->finished.rcu, drm_sched_fence_free) (sys/dev/drm/scheduler/sched_fence.c:107-113), so a plain single-threaded run reads pre-free memory; manifestation needs the RCU grace period (or preemption) between :1501 and :1508, and the stale value is returned to userspace as the ioctl errno — a 4-byte heap oracle (whether the slot got reallocated by a concurrently-submitted job, and the new fence's error code). Impact ceiling: info oracle + theoretical crash; kept Low.

Guest verification (this audit)

Hardware-gated like DF-4262..64 (no AMD GPU): trigger builds (build.log), run exits at open (run.log); baseline + patched in-tree compile rc=0 with -Werror (kmod_baseline_build.log, fix_build.log — reorder so the put happens after the error read, all exit paths covered).

Fix

fix.diff: restructure the loop body so fence->error is read before dma_fence_put() and every exit path (r<0 return, r==0 break, error return, loop continue) puts the reference exactly once.

DF-4265 evidence pack — verdict

Reproduced? NOT at runtime — hardware-gated (no AMD GPU on the audit guest). Defect certain at code level; realistic manifestation is a narrow race (RCU-deferred free), hence confidence=likely for end-to-end impact.

Proof chain

1. amdgpu_cs_wait_fences_ioctl() (amdgpu_cs.c:1590-1622) with wait_all=1 reaches amdgpu_cs_wait_all_fences() (:1481-1516).
2. fence = amdgpu_cs_get_fence(...) (:1494) returns a referenced fence: amdgpu_ctx_get_fence() does dma_fence_get(centity->fences[seq & (amdgpu_sched_jobs-1)]) (amdgpu_ctx.c:489) — our own reference on top of the context array's.
3. Body of the loop (:1500-1509): r = dma_fence_wait_timeout(fence, true, timeout); dma_fence_put(fence); / :1501 / ... if (fence->error) / :1508 — read AFTER put / return fence->error;
4. The context array reference is dropped when the slot is overwritten by a later submission: amdgpu_ctx_add_fence() (amdgpu_ctx.c:440-464) replaces centity->fences[seq & 31] and dma_fence_put(other) (:461). After 32 further submissions on the entity (plus normal scheduler teardown of the finished job), the reference dropped at :1501 can be the final one.
5. Free path on this tree: dma_fence_put → kref → drm_sched_fence_release_finished (sched_fence.c:122-127) → put of the embedded scheduled fence → drm_sched_fence_release_scheduled (sched_fence.c:107-113) → call_rcu(..., drm_sched_fence_free) — the slab object is returned to sched_fence_slab only after an RCU grace period. Between :1501 and :1508 there are no RCU read-side critical sections holding it, so the read is a genuine use-after-free in the C sense; practical manifestation requires the grace period to elapse inside the window (preemption + idle machine makes this possible but rare). If freed+reallocated (attacker submits jobs concurrently — drm_sched_fence_create allocates from the same slab), :1508 reads the NEW object's error field and returns it as the ioctl's errno → 4-byte heap oracle. If freed and not reused, the read touches slab memory (typically non-fatal).
6. The correct ordering exists in the sibling ioctl amdgpu_cs_wait_ioctl() (:1367-1371: error read precedes the put) — this is a local defect of wait_all_fences only.

Guest verification performed

• trigger compiles (build.log); runs to the hardware gate (run.log)
• baseline + patched (reordered put) in-tree compile rc=0 with -Werror (kmod_baseline_build.log / fix_build.log; fix hunk at :1498+)

Exploit chain: read-only oracle; no write primitive; no escalation path.

Recommended fix: read fence->error before dma_fence_put(fence), covering all exit paths (fix.diff).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.