DF-3979 / df3979_event_source.c
/* * df3979_event_source.c -- DF-3979 source-level demonstration stub. * * dcn10_enable_per_frame_crtc_position_reset() * (sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:1406) dereferences * grouped_pipes[i]->stream->triggered_crtc_reset.event_source->status.primary_otg_inst * without a NULL check on event_source. The twin deref in * dce110_enable_per_frame_crtc_position_reset was filed as DF-3948; upstream * Linux removed the deref entirely by v5.4 (hardcodes 0 as the master OTG). * * DEAD PATH today: `triggered_crtc_reset.enabled` is never set true anywhere * in this tree (amdgpu_dm.c:dm_enable_per_frame_crtc_master_sync() only ever * *reads* .enabled; the VSDB-based enable is a TODO), and dc.c:794 skips every * pipe with enabled==0 before calling the hwss hook, so the deref is * unreachable unless a future change enables the multisync trigger. * * No runtime trigger is possible on the audit guest (no DCN10 GPU), and the * path is dead code regardless -- this file documents the exact precondition * chain rather than a runnable PoC. */ #include <stdio.h> int main(void) { printf("DF-3979: dead-path NULL deref; see VERDICT.md for the " "call-chain proof (dc.c:794 gating + no producer of " "triggered_crtc_reset.enabled). " "Not runnable: no DCN10 hardware on the audit guest.\n"); return 0; } |