AMD General ping
> -----Original Message----- > From: Clement, Sunday <[email protected]> > Sent: Tuesday, July 28, 2026 4:45 PM > To: [email protected] > Cc: Clement, Sunday <[email protected]>; Cui, Flora > <[email protected]>; [email protected]; Clement, Sunday > <[email protected]> > Subject: [PATCH] drm/amd/dkms: Fix TOCTOU symlink race in build directory > creation > > The DKMS Makefile used mktemp -u to generate a temporary directory name > without atomically creating it, then root-privileged pre-build.sh later > created a > symlink at that path. A local unprivileged attacker could race to create a > malicious > symlink at the predicted path between name generation and actual use, > redirecting root file writes or rm -rf cleanup to arbitrary paths. This > attack recurs > on every DKMS rebuild during kernel updates. > > Fix by replacing mktemp -ut with mktemp -dt to atomically create the directory > with mode 0700. Update pre-build.sh to remove the directory and recreate as > symlink. > > Signed-off-by: Sunday Clement <[email protected]> > --- > drivers/gpu/drm/amd/dkms/Makefile | 2 +- > drivers/gpu/drm/amd/dkms/pre-build.sh | 4 ++++ > 2 files changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/amd/dkms/Makefile > b/drivers/gpu/drm/amd/dkms/Makefile > index 8112b9746c8f..02eea52ae0e7 100644 > --- a/drivers/gpu/drm/amd/dkms/Makefile > +++ b/drivers/gpu/drm/amd/dkms/Makefile > @@ -4,7 +4,7 @@ else > KERNELVER ?= $(shell uname -r) > kernel_build_dir := /lib/modules/$(KERNELVER)/build module_src_dir := > $(CURDIR) -module_build_dir := $(shell mktemp -ut amd.XXXXXXXX) > +module_build_dir := $(shell mktemp -dt amd.XXXXXXXX) > module_build_flags := > num_cpu_cores := $(shell which nproc > /dev/null && nproc || echo "1") CC := > gcc diff --git a/drivers/gpu/drm/amd/dkms/pre-build.sh > b/drivers/gpu/drm/amd/dkms/pre-build.sh > index 66f7177b6cf9..24f5a13ad854 100755 > --- a/drivers/gpu/drm/amd/dkms/pre-build.sh > +++ b/drivers/gpu/drm/amd/dkms/pre-build.sh > @@ -100,6 +100,10 @@ if version_lt 6.0; then fi > > export KERNELVER > +# Security: MODULE_BUILD_DIR is now atomically created by mktemp -d > +(mode 0700) # to eliminate TOCTOU symlink race. We need > +MODULE_BUILD_DIR to be # a symlink to DKMS_TREE, so remove the directory > and recreate as symlink. > +rmdir $MODULE_BUILD_DIR > ln -s $DKMS_TREE $MODULE_BUILD_DIR > echo "PATH=$PATH" >$MODULE_BUILD_DIR/.env > > -- > 2.43.0
