[PATCH] drm/amd/dkms: Fix TOCTOU symlink race in build directory creation

[PATCH] drm/amd/dkms: Fix TOCTOU symlink race in build directory creation

[Sunday Clement]

The DKMS Makefile used mktemp -u to generate a temporary directory name
without atomically creating it, then root-privileged pre-build.sh later
created a symlink at that path. A local unprivileged attacker could race
to create a malicious symlink at the predicted path between name
generation and actual use, redirecting root file writes or rm -rf
cleanup to arbitrary paths. This attack recurs on every DKMS rebuild
during kernel updates.

Fix by replacing mktemp -ut with mktemp -dt to atomically create the
directory with mode 0700. Update pre-build.sh to remove the directory
and recreate as symlink.

Signed-off-by: Sunday Clement <sunday.clement@amd.com>
---
 drivers/gpu/drm/amd/dkms/Makefile     | 2 +-
 drivers/gpu/drm/amd/dkms/pre-build.sh | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/dkms/Makefile b/drivers/gpu/drm/amd/dkms/Makefile
index 8112b9746c8f..02eea52ae0e7 100644
--- a/drivers/gpu/drm/amd/dkms/Makefile
+++ b/drivers/gpu/drm/amd/dkms/Makefile
@@ -4,7 +4,7 @@ else
 KERNELVER ?= $(shell uname -r)
 kernel_build_dir := /lib/modules/$(KERNELVER)/build
 module_src_dir := $(CURDIR)
-module_build_dir := $(shell mktemp -ut amd.XXXXXXXX)
+module_build_dir := $(shell mktemp -dt amd.XXXXXXXX)
 module_build_flags :=
 num_cpu_cores := $(shell which nproc > /dev/null && nproc || echo "1")
 CC := gcc
diff --git a/drivers/gpu/drm/amd/dkms/pre-build.sh b/drivers/gpu/drm/amd/dkms/pre-build.sh
index 66f7177b6cf9..24f5a13ad854 100755
--- a/drivers/gpu/drm/amd/dkms/pre-build.sh
+++ b/drivers/gpu/drm/amd/dkms/pre-build.sh
@@ -100,6 +100,10 @@ if version_lt 6.0; then
 fi
 
 export KERNELVER
+# Security: MODULE_BUILD_DIR is now atomically created by mktemp -d (mode 0700)
+# to eliminate TOCTOU symlink race. We need MODULE_BUILD_DIR to be
+# a symlink to DKMS_TREE, so remove the directory and recreate as symlink.
+rmdir $MODULE_BUILD_DIR
 ln -s $DKMS_TREE $MODULE_BUILD_DIR
 echo "PATH=$PATH" >$MODULE_BUILD_DIR/.env
 
-- 
2.43.0