Unbounded pitch underflow in hubp1_program_size can hang the GPU
Summary
dcn10_hubp.c:171-174 pitch = luma_pitch-1 / chroma_pitch-1 / meta_pitch_l-1 / meta_pitch_c-1; 176-177 pitch = surface_pitch-1 / meta_pitch-1. Unsigned fields; 0-1 wraps to 0xFFFFFFFF -> register field max value. Comment at 169: Chroma pitch zero can cause system hang!. ASSERT only (WARN_ON production). DRM_MASTER: AddFB2 with pitches[0]=0 -> hubp_program_size -> GPU hang. Some DRM core validators may reject pitch=0. Fix: if(luma_pitch==0 || chroma_pitch==0 || surface_pitch==0) return.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1613 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 609 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 725 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1613 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: dcn10_hubp.c:171-174 pitch = luma_pitch-1 / chroma_pitch-1 / meta_pitch_l-1 / meta_pitch_c-1; 176-177 pitch = surface_pitch-1 / meta_pitch-1. Unsigned fields; 0-1 wraps to 0xFFFFFFFF -> register field
Citation: sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:167-177
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: pitch-1 underflow to 0xFFFFFFFF when pitch=0 (dcn10_hubp.c:171-177)
Verified recommended fix
Source-confirmed: pitch-1 underflow to 0xFFFFFFFF when pitch=0 (dcn10_hubp.c:171-177)
Verdict
Source-confirmed: pitch-1 underflow to 0xFFFFFFFF when pitch=0 (dcn10_hubp.c:171-177)
No comments yet.