Use of uninitialized stack variable n_entries when icl_get_combo_buf_trans hits default branch
Summary
icl_get_combo_buf_trans() at intel_ddi.c:873-910: default branches at :890/:905 return NULL without setting *n_entries. VOLTAGE_INFO_MASK is 2 bits, 4th value (3<<24) unhandled. Callers intel_ddi_hdmi_level (:914 uninit int n_entries, read at :924/:946) and intel_ddi_dp_voltage_max (:2235 uninit, read at :2260 WARN_ON) pass uninitialized local. cnl_get_buf_trans_* correctly sets *n_entries=1 in default with comment shut up gcc (:821/:842/:864). Impact: kernel stack bytes influence HDMI level value, wrong buffer-trans entry programmed. Fix: add *n_entries=0 in default arms, init locals to 0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1225 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 697 B | view raw |
DF-1225 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Use of uninitialized stack variable n_entries when icl_get_combo_buf_trans hits default branch
Source Location
sys/dev/drm/i915/intel_ddi.c:890-946
Verdict
Source-confirmed: Use of uninitialized stack variable n_entries when icl_get_combo_buf_t. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
icl_get_combo_buf_trans() at intel_ddi.c:873-910: default branches at :890/:905 return NULL without setting n_entries. VOLTAGE_INFO_MASK is 2 bits, 4th value (3<<24) unhandled. Callers intel_ddi_hdmi_level (:914 uninit int n_entries, read at :924/:946) and intel_ddi_dp_voltage_max (:2235 uninit, read at :2260 WARN_ON) pass uninitialized local. cnl_get_buf_trans_ correctly sets *n_entries=1 in default with comment shut up gcc (:821/:842/:864). Impact: kernel stack bytes influence HDMI level val
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: icl_get_combo_buf_trans default branch returns NULL without setting *n_entries, caller may use uninitialized value. Added *n_entries=0 before return.
Verified recommended fix
Source-confirmed: icl_get_combo_buf_trans default branch returns NULL without setting n_entries, caller may use uninitialized value. Added n_entries=0 before return.
Verdict
Source-confirmed: icl_get_combo_buf_trans default branch returns NULL without setting n_entries, caller may use uninitialized value. Added n_entries=0 before return.
No comments yet.