⬢ DragonFlyBSD Kernel Audit
DF-3702 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
{
  "finding_id": "DF-3702",
  "title": "vega10 backend-init NULL-derefs optional pptable subtables (tdp/mm/lookup/dep tables)",
  "verdict": "inconclusive",
  "impact": "source-certain NULL-deref kernel panic at amdgpu attach; not demonstrable on guest",
  "reproduce": {
    "build": "n/a — trigger is a crafted VBIOS powerplay table (zero us*TableOffset fields)",
    "run": "flash/attach doctored Vega10 card -> driver attach panics in vega10_hwmgr_backend_init",
    "expected": "kernel NULL-deref panic at vega10_hwmgr.c:269 or :658/:661/:665/:677/:680"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:269",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:658",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:661",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:665",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:677",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:905"
  ],
  "artifacts": ["README.md","VERDICT.md","trigger_notes.c","build.sh","run.sh","run.log","env.txt","fix.diff","manifest.json","verdict.json"]
}