⬢ DragonFlyBSD Kernel Audit
DF-3979 / df3979_event_source.c
← back to finding ↓ download raw
/*
 * df3979_event_source.c -- DF-3979 source-level demonstration stub.
 *
 * dcn10_enable_per_frame_crtc_position_reset()
 * (sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:1406) dereferences
 *     grouped_pipes[i]->stream->triggered_crtc_reset.event_source->status.primary_otg_inst
 * without a NULL check on event_source.  The twin deref in
 * dce110_enable_per_frame_crtc_position_reset was filed as DF-3948; upstream
 * Linux removed the deref entirely by v5.4 (hardcodes 0 as the master OTG).
 *
 * DEAD PATH today: `triggered_crtc_reset.enabled` is never set true anywhere
 * in this tree (amdgpu_dm.c:dm_enable_per_frame_crtc_master_sync() only ever
 * *reads* .enabled; the VSDB-based enable is a TODO), and dc.c:794 skips every
 * pipe with enabled==0 before calling the hwss hook, so the deref is
 * unreachable unless a future change enables the multisync trigger.
 *
 * No runtime trigger is possible on the audit guest (no DCN10 GPU), and the
 * path is dead code regardless -- this file documents the exact precondition
 * chain rather than a runnable PoC.
 */
#include <stdio.h>

int main(void)
{
	printf("DF-3979: dead-path NULL deref; see VERDICT.md for the "
	       "call-chain proof (dc.c:794 gating + no producer of "
	       "triggered_crtc_reset.enabled). "
	       "Not runnable: no DCN10 hardware on the audit guest.\n");
	return 0;
}