⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1450

Missing return after ASSERT_CRITICAL(false) in dc_link_set_drive_settings allows NULL deref fall-through

Summary

dc_link_set_drive_settings at dc.c:442: ASSERT_CRITICAL(false) is WARN_ON (no-op in production). No return. :444 dc_link_dp_set_drive_settings(dc->links[i]) with i==link_count -> links[i] is NULL -> dp_set_hw_lane_settings derefs NULL->link_enc -> panic. Only in-tree caller (debugfs root-only) always passes valid link. Defense-in-depth. Fix: add return after ASSERT_CRITICAL.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1450 · 1 files
FileTypeDescriptionSize
manifest.json file 406 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/dev/drm/amd/display/dc/core/dc.c:429: missing return after ASSERT_CRITICAL(false) allows NULL deref fall-through

Verified recommended fix

Source-confirmed at sys/dev/drm/amd/display/dc/core/dc.c:429: missing return after ASSERT_CRITICAL(false) allows NULL deref fall-through

Verdict

Source-confirmed at sys/dev/drm/amd/display/dc/core/dc.c:429: missing return after ASSERT_CRITICAL(false) allows NULL deref fall-through