NULL-deref of ddc_bus in radeon_dvi_detect shared-DDC loop (RS690/RS740 floating-bus nulls ddc_bus but leaves shared_ddc=true)
Summary
radeon_dvi_detect at radeon_connectors.c:1340-1342: if(list_radeon_connector->shared_ddc && (list_radeon_connector->ddc_bus->rec.i2c_id==...)). RS690/RS740 path :1305-1310 nulls ddc_bus for floating-bus workaround but does NOT clear shared_ddc. Sibling connector probe scans neighbors, reaches nullled connector -> NULL deref of ddc_bus->rec. Malicious monitor on RS690/RS740 shared DDC. Fix: add ddc_bus!=NULL check, clear shared_ddc when nulling.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1344 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1011 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 346 B | view raw |
DF-1344 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
NULL-deref of ddc_bus in radeon_dvi_detect shared-DDC loop (RS690/RS740 floating-bus nulls ddc_bus but leaves shared_ddc=true)
Source Location
sys/dev/drm/radeon/radeon_connectors.c:1340-1310
Verdict
Source-confirmed (complex fix): NULL-deref of ddc_bus in radeon_dvi_detect shared-DDC loop (RS690/RS74. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
radeon_dvi_detect at radeon_connectors.c:1340-1342: if(list_radeon_connector->shared_ddc && (list_radeon_connector->ddc_bus->rec.i2c_id==...)). RS690/RS740 path :1305-1310 nulls ddc_bus for floating-bus workaround but does NOT clear shared_ddc. Sibling connector probe scans neighbors, reaches nullled connector -> NULL deref of ddc_bus->rec. Malicious monitor on RS690/RS740 shared DDC. Fix: add ddc_bus!=NULL check, clear shared_ddc when nulling.
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: radeon_dvi_detect shared-DDC loop dereferences ddc_bus when RS690/RS740 floating-bus nulls it but leaves shared_ddc=true. Complex fix. HW-gated.
Verified recommended fix
Source-confirmed: radeon_dvi_detect shared-DDC loop dereferences ddc_bus when RS690/RS740 floating-bus nulls it but leaves shared_ddc=true. Complex fix. HW-gated.
Verdict
Source-confirmed: radeon_dvi_detect shared-DDC loop dereferences ddc_bus when RS690/RS740 floating-bus nulls it but leaves shared_ddc=true. Complex fix. HW-gated.
No comments yet.