⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1618

Integer underflow in dce120_timing_generator_validate_timing defeats the v_blank lower-bound check

Summary

dce120_timing_generator.c:107-111 v_blank = (v_total - v_addressable - v_border_top - v_border_bottom) * interlace_factor. All uint32_t; if v_addressable + borders > v_total the subtraction wraps to ~UINT32_MAX. Line 121 if (v_blank < min_v_blank=3) check passes because wrapped value is huge. dce110 parent at 1144 checks h ordering but NOT v ordering. Accepted bad timing -> dce120_program_blanking writes wrapped values to CRTC_V_BLANK registers. DRM_MASTER user on DCE12 (Vega10). Bounded by 14-bit field mask so no MMIO OOB; display corruption / GPU fault. Fix: reject v_total < v_addressable + v_border_top + v_border_bottom before subtraction.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1618 · 4 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able fix for the cited bug 677 B view raw
VERDICT.md verdict source-confirmation analysis 739 B ↓ raw
build.sh build-script N/A (source-only) 61 B view raw
run.sh run-script N/A (source-only) 87 B view raw
VERDICT.md verdict source-confirmation analysis
↓ download raw

DF-1618 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: dce120_timing_generator.c:107-111 v_blank = (v_total - v_addressable - v_border_top - v_border_bottom) * interlace_factor. All uint32_t; if v_addressable + borders > v_total the subtraction wraps to ~

Citation: sys/dev/drm/amd/display/dc/dce120/dce120_timing_generator.c:107-126

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: v_blank uint32 underflow when addressable>borders>v_total (dce120_timing_generator.c:107-111)

Verified recommended fix

Source-confirmed: v_blank uint32 underflow when addressable>borders>v_total (dce120_timing_generator.c:107-111)

Verdict

Source-confirmed: v_blank uint32 underflow when addressable>borders>v_total (dce120_timing_generator.c:107-111)