⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1594

Uninitialized rv515_watermark.sclk read writes garbage to display priority MMIO

Summary

rv515.c:946 struct rv515_watermark has sclk field. 958/976-977 rv515_crtc_bandwidth_compute computes LOCAL sclk from selected_sclk but NEVER writes to wm->sclk (zero write sites for wm->sclk in file). rv515_bandwidth_avivo_update stack-allocates 4 rv515_watermark WITHOUT init (1233-1234). rv515_compute_mode_priority reads wm0->sclk (1129) and wm1->sclk (1204) -> uninitialized stack garbage used in fill_rate arithmetic -> garbage D1/D2MODE_PRIORITY_A/B_CNT WREG32 (1264-1267). Nondeterministic display FIFO priority corruption on every mode set. Siblings rs690.c evergreen.c have same missing-write pattern. Fix: wm->sclk.full = sclk.full + zero-init stack structs.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1594 · 4 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able fix for the cited bug 566 B view raw
VERDICT.md verdict source-confirmation analysis 707 B ↓ raw
build.sh build-script N/A (source-only) 61 B view raw
run.sh run-script N/A (source-only) 87 B view raw
VERDICT.md verdict source-confirmation analysis
↓ download raw

DF-1594 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: rv515.c:946 struct rv515_watermark has sclk field. 958/976-977 rv515_crtc_bandwidth_compute computes LOCAL sclk from selected_sclk but NEVER writes to wm->sclk (zero write sites for wm->sclk in file).

Citation: sys/dev/drm/radeon/rv515.c:946-1267

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: uninitialized rv515_watermark.sclk read writes garbage (rv515.c:946,1233-1234)

Verified recommended fix

Source-confirmed: uninitialized rv515_watermark.sclk read writes garbage (rv515.c:946,1233-1234)

Verdict

Source-confirmed: uninitialized rv515_watermark.sclk read writes garbage (rv515.c:946,1233-1234)