RE: [PATCH] drm/amd/dkms: Fix TOCTOU symlink race in build directory creation

AMD General

ping

> -----Original Message-----
> From: Clement, Sunday <[email protected]>
> Sent: Tuesday, July 28, 2026 4:45 PM
> To: [email protected]
> Cc: Clement, Sunday <[email protected]>; Cui, Flora
> <[email protected]>; [email protected]; Clement, Sunday
> <[email protected]>
> Subject: [PATCH] drm/amd/dkms: Fix TOCTOU symlink race in build directory
> creation
>
> The DKMS Makefile used mktemp -u to generate a temporary directory name
> without atomically creating it, then root-privileged pre-build.sh later c=
reated a
> symlink at that path. A local unprivileged attacker could race to create =
a malicious
> symlink at the predicted path between name generation and actual use,
> redirecting root file writes or rm -rf cleanup to arbitrary paths. This a=
ttack recurs
> on every DKMS rebuild during kernel updates.
>
> Fix by replacing mktemp -ut with mktemp -dt to atomically create the dire=
ctory
> with mode 0700. Update pre-build.sh to remove the directory and recreate =
as
> symlink.
>
> Signed-off-by: Sunday Clement <[email protected]>
> ---
>  drivers/gpu/drm/amd/dkms/Makefile     | 2 +-
>  drivers/gpu/drm/amd/dkms/pre-build.sh | 4 ++++
>  2 files changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/dkms/Makefile
> b/drivers/gpu/drm/amd/dkms/Makefile
> index 8112b9746c8f..02eea52ae0e7 100644
> --- a/drivers/gpu/drm/amd/dkms/Makefile
> +++ b/drivers/gpu/drm/amd/dkms/Makefile
> @@ -4,7 +4,7 @@ else
>  KERNELVER ?=3D $(shell uname -r)
>  kernel_build_dir :=3D /lib/modules/$(KERNELVER)/build  module_src_dir :=
=3D
> $(CURDIR) -module_build_dir :=3D $(shell mktemp -ut amd.XXXXXXXX)
> +module_build_dir :=3D $(shell mktemp -dt amd.XXXXXXXX)
>  module_build_flags :=3D
>  num_cpu_cores :=3D $(shell which nproc > /dev/null && nproc || echo "1")=
  CC :=3D
> gcc diff --git a/drivers/gpu/drm/amd/dkms/pre-build.sh
> b/drivers/gpu/drm/amd/dkms/pre-build.sh
> index 66f7177b6cf9..24f5a13ad854 100755
> --- a/drivers/gpu/drm/amd/dkms/pre-build.sh
> +++ b/drivers/gpu/drm/amd/dkms/pre-build.sh
> @@ -100,6 +100,10 @@ if version_lt 6.0; then  fi
>
>  export KERNELVER
> +# Security: MODULE_BUILD_DIR is now atomically created by mktemp -d
> +(mode 0700) # to eliminate TOCTOU symlink race. We need
> +MODULE_BUILD_DIR to be # a symlink to DKMS_TREE, so remove the directory
> and recreate as symlink.
> +rmdir $MODULE_BUILD_DIR
>  ln -s $DKMS_TREE $MODULE_BUILD_DIR
>  echo "PATH=3D$PATH" >$MODULE_BUILD_DIR/.env
>
> --
> 2.43.0