⬢ DragonFlyBSD Kernel Audit
DF-3899 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3899",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Off-by-one in the bounds guard of intel_get_shared_dpll_id() (intel_dpll_mgr.c:103-107): the > comparison lets an exactly-one-past-end pointer through and the function returns id == num_shared_dpll (== 7 == I915_NUM_PLLS on ICL, an out-of-bounds index). All current callers pass in-array or NULL pointers (NULL is caught by the < clause), so the defect is unreachable today; it negates the guards sole purpose of protecting future callers, whose register-macro consumers (DPLL_CTRL1_*_MASK(pll_id), ICL/CNL_DPLL_CFGCR0(pll_id) at intel_ddi.c:1537/1563/1617) would mis-index. Info hardening; no runtime test possible on the QEMU guest (no Intel display HW, dpll_mgr stays NULL at intel_dpll_mgr.c:3295).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3899/VERDICT.md (full caller audit), README.md, fix.diff; decisive lines: intel_dpll_mgr.c:103-107 (guard+subtract), i915_drv.h:1793 + intel_dpll_mgr.h:137 (array size 7 == ICL num_shared_dpll), intel_ddi.c:1617-1625 / 1537-1543 / 1563-1565 (id used as register macro index)",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_dpll_mgr.c:99",
    "sys/dev/drm/i915/intel_dpll_mgr.c:103",
    "sys/dev/drm/i915/intel_dpll_mgr.c:107",
    "sys/dev/drm/i915/intel_dpll_mgr.c:3206",
    "sys/dev/drm/i915/i915_drv.h:1793",
    "sys/dev/drm/i915/intel_dpll_mgr.h:137",
    "sys/dev/drm/i915/intel_ddi.c:1537",
    "sys/dev/drm/i915/intel_ddi.c:1563",
    "sys/dev/drm/i915/intel_ddi.c:1617"
  ],
  "poc_changes": "no PoC authored: Info-tier hardening finding, hardware-gated (requires Intel i915 display + a hypothetical out-of-range caller); Phase V skip rule for Low/Info findings applied, status recorded as untested",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Negative-result companion audit of the same file is recorded in the pass-2 task_log: div-by-zero twins of DF-1226/3810 killed (all denominators constant, static-table, or cdclk.hw.ref which is forced to {19200,24000,38400} by intel_cdclk.c:1916-1930 MISSING_CASE fallthrough; no readback-derived divisors exist in this file); every intel_find_shared_dpll range and get_shared_dpll_by_id id verified in-bounds per platform; funcs->prepare NULL-call (intel_prepare_shared_dpll:150) unreachable because its only caller ironlake_crtc_enable is has_pch_encoder-gated (intel_display.c:5650) and only ibx_pch_dpll_funcs defines prepare; icl_get_dpll enc_to_dig_port type-confusion killed because enc_to_dig_port is checked (intel_drv.h:1286-1294) and DSI is gated off at haswell_crtc_compute_clock (intel_display.c:9362); dpll_lock discipline and staged-atomic refcounting verified leak/double-put-free.",
  "recommended_fix": "Rewrite the guard index-based: long pll_idx = pll - dev_priv->shared_dplls; WARN_ON(pll_idx < 0 || pll_idx >= dev_priv->num_shared_dpll); return pll_idx;",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff mirrors upstreams index-based >= guard; no runtime validation possible on the guest (no Intel display hardware; defect has no reachable trigger with current callers), so fix validation is not_testable rather than fixed",
  "fix_evidence": "findings/poc/DF-3899/fix.diff"
}