[PATCH] drm/amd/dkms: Fix TOCTOU symlink race in build directory creation

[PATCH] drm/amd/dkms: Fix TOCTOU symlink race in build directory creation

[Sunday Clement]

The DKMS Makefile used mktemp -u to generate a temporary directory name
without atomically creating it, then root-privileged pre-build.sh later
created a symlink at that path. A local unprivileged attacker could race
to create a malicious symlink at the predicted path between name
generation and actual use, redirecting root file writes or rm -rf
cleanup to arbitrary paths. This attack recurs on every DKMS rebuild
during kernel updates.

Fix by replacing mktemp -ut with mktemp -dt to atomically create the
directory with mode 0700. Update pre-build.sh to remove the directory
and recreate as symlink.

Signed-off-by: Sunday Clement <sunday.clement@amd.com>
---
 drivers/gpu/drm/amd/dkms/Makefile     | 2 +-
 drivers/gpu/drm/amd/dkms/pre-build.sh | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/dkms/Makefile b/drivers/gpu/drm/amd/dkms/Makefile
index 8112b9746c8f..02eea52ae0e7 100644
--- a/drivers/gpu/drm/amd/dkms/Makefile
+++ b/drivers/gpu/drm/amd/dkms/Makefile
@@ -4,7 +4,7 @@ else
 KERNELVER ?= $(shell uname -r)
 kernel_build_dir := /lib/modules/$(KERNELVER)/build
 module_src_dir := $(CURDIR)
-module_build_dir := $(shell mktemp -ut amd.XXXXXXXX)
+module_build_dir := $(shell mktemp -dt amd.XXXXXXXX)
 module_build_flags :=
 num_cpu_cores := $(shell which nproc > /dev/null && nproc || echo "1")
 CC := gcc
diff --git a/drivers/gpu/drm/amd/dkms/pre-build.sh b/drivers/gpu/drm/amd/dkms/pre-build.sh
index 66f7177b6cf9..24f5a13ad854 100755
--- a/drivers/gpu/drm/amd/dkms/pre-build.sh
+++ b/drivers/gpu/drm/amd/dkms/pre-build.sh
@@ -100,6 +100,10 @@ if version_lt 6.0; then
 fi
 
 export KERNELVER
+# Security: MODULE_BUILD_DIR is now atomically created by mktemp -d (mode 0700)
+# to eliminate TOCTOU symlink race. We need MODULE_BUILD_DIR to be
+# a symlink to DKMS_TREE, so remove the directory and recreate as symlink.
+rmdir $MODULE_BUILD_DIR
 ln -s $DKMS_TREE $MODULE_BUILD_DIR
 echo "PATH=$PATH" >$MODULE_BUILD_DIR/.env
 
-- 
2.43.0

RE: [PATCH] drm/amd/dkms: Fix TOCTOU symlink race in build directory creation

[Clement, Sunday]

AMD General

ping

> -----Original Message-----
> From: Clement, Sunday <Sunday.Clement@amd.com>
> Sent: Tuesday, July 28, 2026 4:45 PM
> To: amd-gfx@lists.freedesktop.org
> Cc: Clement, Sunday <Sunday.Clement@amd.com>; Cui, Flora
> <Flora.Cui@amd.com>; Russell.Kent@amd.com; Clement, Sunday
> <Sunday.Clement@amd.com>
> Subject: [PATCH] drm/amd/dkms: Fix TOCTOU symlink race in build directory
> creation
>
> The DKMS Makefile used mktemp -u to generate a temporary directory name
> without atomically creating it, then root-privileged pre-build.sh later created a
> symlink at that path. A local unprivileged attacker could race to create a malicious
> symlink at the predicted path between name generation and actual use,
> redirecting root file writes or rm -rf cleanup to arbitrary paths. This attack recurs
> on every DKMS rebuild during kernel updates.
>
> Fix by replacing mktemp -ut with mktemp -dt to atomically create the directory
> with mode 0700. Update pre-build.sh to remove the directory and recreate as
> symlink.
>
> Signed-off-by: Sunday Clement <sunday.clement@amd.com>
> ---
>  drivers/gpu/drm/amd/dkms/Makefile     | 2 +-
>  drivers/gpu/drm/amd/dkms/pre-build.sh | 4 ++++
>  2 files changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/dkms/Makefile
> b/drivers/gpu/drm/amd/dkms/Makefile
> index 8112b9746c8f..02eea52ae0e7 100644
> --- a/drivers/gpu/drm/amd/dkms/Makefile
> +++ b/drivers/gpu/drm/amd/dkms/Makefile
> @@ -4,7 +4,7 @@ else
>  KERNELVER ?= $(shell uname -r)
>  kernel_build_dir := /lib/modules/$(KERNELVER)/build  module_src_dir :=
> $(CURDIR) -module_build_dir := $(shell mktemp -ut amd.XXXXXXXX)
> +module_build_dir := $(shell mktemp -dt amd.XXXXXXXX)
>  module_build_flags :=
>  num_cpu_cores := $(shell which nproc > /dev/null && nproc || echo "1")  CC :=
> gcc diff --git a/drivers/gpu/drm/amd/dkms/pre-build.sh
> b/drivers/gpu/drm/amd/dkms/pre-build.sh
> index 66f7177b6cf9..24f5a13ad854 100755
> --- a/drivers/gpu/drm/amd/dkms/pre-build.sh
> +++ b/drivers/gpu/drm/amd/dkms/pre-build.sh
> @@ -100,6 +100,10 @@ if version_lt 6.0; then  fi
>
>  export KERNELVER
> +# Security: MODULE_BUILD_DIR is now atomically created by mktemp -d
> +(mode 0700) # to eliminate TOCTOU symlink race. We need
> +MODULE_BUILD_DIR to be # a symlink to DKMS_TREE, so remove the directory
> and recreate as symlink.
> +rmdir $MODULE_BUILD_DIR
>  ln -s $DKMS_TREE $MODULE_BUILD_DIR
>  echo "PATH=$PATH" >$MODULE_BUILD_DIR/.env
>
> --
> 2.43.0