DF-4755

VI mailbox RCV interrupt enabled before flr_work is initialized — host-timed mailbox interrupt executes schedule_work() on an uninitialized (zeroed) work_struct → NULL function-pointer call → kernel panic

Summary

amdgpu_irq_get(rcv_irq) sets VALID_INT_EN at :600 nine lines before INIT_WORK(flr_work) at :609; a host/PF delivering IDH_FLR_NOTIFICATION in that window hits schedule_work on a zeroed work_struct - DFly workqueue shim executes func==NULL (linux_workqueue.c:89) = immediate guest panic. Carried from the Linux port. One-line reorder fix. SR-IOV hw-gated.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — drivers
Confidence: likely
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-457
File: sys/dev/drm/amd/amdgpu/mxgpu_vi.c
Lines: 600-609
Area: dev
Discovered: 2026-09-23
Updated: 2026-09-23

Team triage

untriaged

priority: — · owner: —

PoC verification

untested

Status: untested
Reproduced: no
Impact: panic
Confidence: likely
Tested: 2026-09-23 10:04:33
Attempts: 0
Runtime: —
Code hash: —
Guest: —
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: likely
Tested: 2026-09-23 10:04:33
Runtime: —
Kernel: per-fix-DF-4755
fix.diff: findings/poc/DF-4755/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4755 · 1 files

File	Type	Description	Size
verdict.json	file		1.1 KB	view raw

Fix verification

not_testable

per-fix-DF-4755

Confirmed kernel references

Detail

Exploit chain

host asserts mailbox RCV irq (src 135) right after guest VALID_INT_EN write; rcv_irq matches IDH_FLR_NOTIFICATION; schedule_work(&adev->virt.flr_work) with uninitialized work; process_all_work calls NULL func -> guest kernel panic

Evidence (decisive lines)

findings/poc/DF-4755/ (this verdict; reviewer notes in DF-4754 batch record)

Verdict

Source-certain init-ordering race, hardware-gated: requires an SR-IOV AMD VI VF (Tonga/Fiji) and a host/PF delivering the mailbox RCV interrupt in the window between amdgpu_irq_get(rcv_irq) at mxgpu_vi.c:600 (sets VALID_INT_EN) and INIT_WORK(flr_work) at :609 - schedule_work on the zeroed work_struct executes func==NULL via linux_workqueue.c:89. No SR-IOV AMD GPU on the QEMU guest, so runtime verification is not possible. Fix is a one-line reorder (INIT_WORK first), not yet build-validated.