⬢ DragonFlyBSD Kernel Audit
DF-3980 / df3980_opp_order.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
/*
 * df3980_opp_order.c -- DF-3980 documentation stub.
 *
 * hwss1_plane_atomic_disconnect()
 * (sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:880-907):
 *
 *   struct output_pixel_processor *opp = pipe_ctx->stream_res.opp;
 *   mpc_tree_params = &(opp->mpc_tree_params);            // :889  USE
 *   mpcc_to_remove = mpc->funcs->get_mpcc_for_dpp(mpc_tree_params, dpp_id);
 *   ...
 *   mpc->funcs->remove_mpcc(mpc, mpc_tree_params, mpcc_to_remove);
 *   if (opp != NULL)                                      // :897  CHECK (dead)
 *           opp->mpcc_disconnect_pending[...] = true;
 *
 * The NULL check exists but sits AFTER two dereferences -- it can never
 * protect them.  Currently unreachable: both callers guarantee opp != NULL
 * (dcn10_init_hw assigns stream_res.opp at :1076 before calling at :1078;
 * dcn10_apply_ctx_for_surface reaches the call only for old pipes that had
 * a plane, hence mapped OPP resources).  Upstream Linux v5.4 has the
 * identical misplaced check, so this is a carried-in latent defect.
 *
 * No runtime trigger (no DCN10 GPU in the audit guest; unreachable by
 * construction today) -- source-level hardening finding.
 */
#include <stdio.h>

int main(void)
{
	printf("DF-3980: check-after-use of stream_res.opp in "
	       "hwss1_plane_atomic_disconnect; latent (callers guarantee "
	       "non-NULL today). See VERDICT.md.\n");
	return 0;
}