⬢ DragonFlyBSD Kernel Audit
DF-4313 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "finding_id": "DF-4313",
  "finding": "dcn10_resource construct() error path: unchecked dcn10_pp_smu_create() (NULL pp_smu dereferenced via dcn_bw_notify_pplib_of_wm_ranges -> probe-time panic) and leaked pool allocation in dcn10_create_resource_pool on construct failure",
  "file": "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c",
  "lines": [1350, 1357, 1493],
  "verdict": "inconclusive",
  "impact": "none (on this guest: no AMD GPU; potential: OOM-gated NULL-deref panic at GPU probe + KB-scale leak)",
  "confidence": "certain (code path), likely (OOM trigger)",
  "reproduce": {
    "build": "n/a (kernel driver; requires DCN1/Raven ASIC + allocation failure during amdgpu DC pool construction)",
    "run": "n/a on audit guest - see README.md for the fail-inject manual test on real hardware",
    "expected": "pre-fix: kernel NULL-deref panic in dcn_bw_notify_pplib_of_wm_ranges (dcn_calcs.c:1403) when the pp_smu kzalloc fails; post-fix: probe fails gracefully, pool freed"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:1350",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:1357",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:536",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:858",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1399",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1403",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:1493"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff", "env.txt", "verdict.json", "manifest.json"
  ],
  "fix_validated": false
}