⬢ DragonFlyBSD Kernel Audit
DF-5079 / run.2.log
← back to finding ↓ download raw 
=== baseline ===
== DF-5079 replica: dce120 vupdate (no .src_id) -> dce110_vblank_set pipe_ctx[178] OOB ==
mode: BASELINE (verbatim)

enum: VUPDATE1=72 VUPDATE6=77 VBLANK1=78 VBLANK6=83 IRQ_TYPE_VBLANK=78 MAX_PIPES=6
table: vupdate1 src_id=0 ext_id=0 | vblank1 src_id=19 (19..24)
double-baked: even a correct VUPDATE remap underflows — (uint8_t)(VUPDATE1(72) - IRQ_TYPE_VBLANK(78)) = 250

control VBLANK1 set:      arm_vert_intr(tg->pipe_idx=0, id=2)
control VBLANK2 set:      arm_vert_intr(tg->pipe_idx=1, id=2)
control VBLANK3 set:      arm_vert_intr(tg->pipe_idx=2, id=2)
control VBLANK4 set:      arm_vert_intr(tg->pipe_idx=3, id=2)
control VBLANK5 set:      arm_vert_intr(tg->pipe_idx=4, id=2)
control VBLANK6 set:      arm_vert_intr(tg->pipe_idx=5, id=2)
controls ok (vblank path arms pipes 0..5)

trigger: dal_irq_service_set(DC_IRQ_SOURCE_VUPDATE1=72)
   -> dce110_vblank_set: dal_irq_src=INVALID(0), pipe_offset = (uint8_t)(0-78) = 178
   -> core_dc->current_state->res_ctx.pipe_ctx[178] on a 6-entry array ...
Bus error (core dumped)
baseline exit=138

=== fixed ===
== DF-5079 replica: dce120 vupdate (no .src_id) -> dce110_vblank_set pipe_ctx[178] OOB ==
mode: FIXED (pipe_offset derived from table index)

enum: VUPDATE1=72 VUPDATE6=77 VBLANK1=78 VBLANK6=83 IRQ_TYPE_VBLANK=78 MAX_PIPES=6
table: vupdate1 src_id=0 ext_id=0 | vblank1 src_id=19 (19..24)
double-baked: even a correct VUPDATE remap underflows — (uint8_t)(VUPDATE1(72) - IRQ_TYPE_VBLANK(78)) = 250

control VBLANK1 set:      arm_vert_intr(tg->pipe_idx=0, id=2)
control VBLANK2 set:      arm_vert_intr(tg->pipe_idx=1, id=2)
control VBLANK3 set:      arm_vert_intr(tg->pipe_idx=2, id=2)
control VBLANK4 set:      arm_vert_intr(tg->pipe_idx=3, id=2)
control VBLANK5 set:      arm_vert_intr(tg->pipe_idx=4, id=2)
control VBLANK6 set:      arm_vert_intr(tg->pipe_idx=5, id=2)
controls ok (vblank path arms pipes 0..5)

trigger: dal_irq_service_set(DC_IRQ_SOURCE_VUPDATE1=72)
   -> dce110_vblank_set: dal_irq_src=INVALID(0), pipe_offset = (uint8_t)(0-78) = 178
   -> core_dc->current_state->res_ctx.pipe_ctx[178] on a 6-entry array ...
      arm_vert_intr(tg->pipe_idx=0, id=2)
      arm_vert_intr(tg->pipe_idx=1, id=2)
      arm_vert_intr(tg->pipe_idx=2, id=2)
      arm_vert_intr(tg->pipe_idx=3, id=2)
      arm_vert_intr(tg->pipe_idx=4, id=2)
      arm_vert_intr(tg->pipe_idx=5, id=2)

[fixed] VUPDATE1..6 -> pipes 0..5 armed via index-derived offset; exit 0
fixed exit=0