• File: sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c
• Lines: 1151, 1152, 1153, 1155, 1158, 508
• Severity: Low
• CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• CWE: CWE-476 NULL Pointer Dereference
• Confidence: certain

Summary

When the DCN bandwidth calculator decides a plane needs pipe-splitting (dpp_per_plane==2) but no idle secondary pipe is available, find_idle_secondary_pipe() returns NULL.

The result is checked only with ASSERT(), which in production builds compiles to WARN_ON() (os_types.h:76) and does NOT stop execution.

The NULL pointer is then passed to split_stream_across_pipes() which dereferences it unconditionally at line 508 (before the primary_pipe guard at 510), and again to dcn_bw_calc_rq_dlg_ttu() at line 1158, causing an immediate kernel panic.

Root cause

At dcn_calcs.c:1124-1158, inside if (pipe->plane_state) and inside the if (v->dpp_per_plane[input_idx] == 2 || ...) branch, when the plane was not previously split, the code does:

hsplit_pipe = find_idle_secondary_pipe(&context->res_ctx, pool);  /* 1151 */
ASSERT(hsplit_pipe);                                                /* 1152 */
split_stream_across_pipes(&context->res_ctx, pool, pipe, hsplit_pipe); /* 1153-1155 */

ASSERT is defined in os_types.h:72-77 as WARN_ON(!(expr)) when CONFIG_DEBUG_KERNEL_DC is unset (the production case); WARN_ON (sys/dev/drm/include/asm/bug.h:43) prints and returns, it does not abort.

find_idle_secondary_pipe (dc_resource.c:1211-1233) returns NULL when every pipe in res_ctx->pipe_ctx[] has a non-NULL stream.

split_stream_across_pipes (dcn_calcs.c:502-532) executes int pipe_idx = secondary_pipe->pipe_idx; (508) as its very first statement — before the !primary_pipe->plane_state guard at 510 — so a NULL secondary_pipe faults immediately.

Even if that deref survived, dcn_bw_calc_rq_dlg_ttu(dc, v, hsplit_pipe, input_idx) at line 1158 would deref NULL via pipe->dlg_regs at line 441.

Threat

Local denial of service on systems with an AMD DCN1 (Raven Ridge / Raven2 / Picasso / Renoir-derivative) APU.

Reach: any local user holding DRM master on the active VT (normal for a console login session / logind seat) can submit a DRM_IOCTL_MODE_ATOMIC / modeset that calls dcn_validate_bandwidth().

Trigger preconditions: a display configuration where the per-plane bandwidth model demands two DPPs for one plane (high pixel rate, e.g. 4K or high-refresh with scaling) AND all other hardware pipes are already committed by active streams/planes so that find_idle_secondary_pipe() iterates the whole pool without finding stream==NULL.

On DCN1 with pipe_count==4 this is achievable with a loaded multi-display or multi-plane setup.

Impact: immediate kernel NULL-deref panic (A:H) — total system crash, no code execution.

Exploit / PoC

Build on DragonFlyBSD with the radeonkms/amdgpu DC enabled and run on a DCN1 APU (e.g. Ryzen 2200G/2400G/3200G/3400G iGPU).

/* trigger.c — cc -o trigger trigger.c against libdrm */
#include <fcntl.h>
#include <xf86drm.h>
#include <xf86drmMode.h>

/* 1. open /dev/dri/card0 and authenticate as DRM master (or via logind
 *    takeover).
 * 2. enable N=pipe_count displays (or use hardware MST/clone) committing
 *    high-bandwidth modes.
 * 3. construct a DRM atomic commit adding a plane whose source/destination
 *    forces upscaling on the highest pixel-rate connector (e.g. 3840x2160@60
 *    with a scaler ratio >1) while all remaining pipes are claimed by other
 *    active planes/streams.
 * 4. drmModeAtomicCommit(..., DRM_MODE_ATOMIC_ALLOW_MODESET).
 *
 * This drives dcn_validate_bandwidth -> v->dpp_per_plane[k]==2 for the new
 * plane -> find_idle_secondary_pipe returns NULL ->
 * split_stream_across_pipes(NULL) -> panic.
 */

Success criterion: kernel panic with Fatal double fault or NULL-deref fault at split_stream_across_pipes+0xN, system frozen/panicked.

Reproduce determinism by first saturating all-but-one pipe with active planes, then issuing the splitting commit.

Because triggering requires exact hardware and a saturated pipe-pool config, also provide a unit-style repro that monkeypatches find_idle_secondary_pipe to return NULL and invokes dcn_validate_bandwidth directly via a KLD test harness — that variant deterministically panics and is the proof the code path is unguarded.

Recommended fix

Treat ASSERT as documentation, not a check; add a real NULL test and bail out of the split (and the dependent rq/dlg/ttu recompute) when no idle pipe is available, marking the bandwidth validation as failed rather than crashing.

--- a/sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c
+++ b/sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c
@@ -1148,11 +1148,19 @@ bool dcn_validate_bandwidth(
                            dcn_bw_calc_rq_dlg_ttu(dc, v, hsplit_pipe, input_idx);
                        } else {
                            /* pipe not split previously needs split */
                            hsplit_pipe = find_idle_secondary_pipe(&context->res_ctx, pool);
-                           ASSERT(hsplit_pipe);
-                           split_stream_across_pipes(
-                               &context->res_ctx, pool,
-                               pipe, hsplit_pipe);
+                           if (!hsplit_pipe) {
+                               /*
+                                * No idle pipe available for the required split:
+                                * cannot honour this configuration. Abort the
+                                * split instead of dereferencing NULL.
+                                */
+                               ASSERT(0);
+                               kernel_fpu_end();
+                               PERFORMANCE_TRACE_END();
+                               return false;
+                           }
+                           split_stream_across_pipes(
+                               &context->res_ctx, pool,
+                               pipe, hsplit_pipe);
                        }

                        dcn_bw_calc_rq_dlg_ttu(dc, v, hsplit_pipe, input_idx);

Additionally, as defense-in-depth, move the int pipe_idx = secondary_pipe->pipe_idx; deref in split_stream_across_pipes (dcn_calcs.c:508) below a if (!secondary_pipe || !primary_pipe->plane_state) return; guard at the top of the function so any future caller is also protected.

Related findings

• DF-1486 (sibling): fclks.data[-1] OOB read in same file.