⬢ DragonFlyBSD Kernel Audit
DF-4375 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-4375",
  "title": "dce112_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source (DF-4312/4319/4352 twin)",
  "verdict": "inconclusive",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O1 -g -o df4375_plain df4375_poc.c   (DragonFly guest; ASan variant blocked: no libasan)",
    "run": "./df4375_plain",
    "expected": "per-row index-vs-array-size verdicts; all '<-- OOB' rows are the exact reads performed by dce112_resource.c:577-579 for DC-legitimate VBIOS values (TRANSMITTER_UNKNOWN/-1, TRAVIS_CRT/7, TRAVIS_LCD/8, UNIPHY_G/9 into link_enc_regs[7]; CHANNEL_ID_UNKNOWN/0->[-1], DDC_VGA/7->[6], I2C_PAD/8->[7] into link_enc_aux_regs[6]; HPD_SOURCEID_UNKNOWN/7 into link_enc_hpd_regs[6])"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:577",
    "sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:578",
    "sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:579",
    "sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:267",
    "sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:239",
    "sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:253",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:1165",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:1006",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:964",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:925",
    "sys/dev/drm/amd/display/include/grph_object_defs.h:58",
    "sys/dev/drm/amd/display/include/grph_object_defs.h:81"
  ],
  "artifacts": [
    "df4375_poc.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt",
    "fix.diff", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}