DF-4570
cancel_fake_irq() drains fake_irq before hangcheck, so a concurrently-running hangcheck callback can re-arm fake_irq after its drain — intel_breadcrumbs_fake_irq fires on a torn-down engine (use-after-free at driver unload)
Summary
hangcheck re-arms fake_irq at its end when a missed irq is detected; cancel_fake_irq drains fake_irq THEN hangcheck - the freshly-armed fake_irq survives cancellation and fires jiffies+1 later through from_timer(engine) on an engine being freed: UAF on the breadcrumbs. Unpriv user can keep breadcrumbs armed (blocked GPU wait) to widen the window while root unloads. Upstream v4.14 drained hangcheck first - inherited from the newer generation. Swap-the-drains fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4570 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 994 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: no Intel GPU on guest
fix in finding markdown
per-fix-DF-4570
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Drain order (fake_irq before hangcheck) is wrong given hangcheck re-arms fake_irq at its end; v4.14 had the correct order - inherited from the newer generation. Swap-the-drains fix.
Verdict
not_run: Low severity + no Intel GPU on guest; static race timeline in finding
No comments yet.