amdgpu_dm_debugfs: uninitialized stack read of param[] in dp_link_settings_write / dp_phy_settings_write
Summary
DEAD CODE (see DF-1764). dp_link_settings_write 155 long param[2] NO initializer; token-parse loop 181-193 writes param[0] only for 1-token input leaving param[1] uninit; 205 switch(param[1]) reads uninit; 228 prefer_link_settings.link_rate=param[1]; 230 dc_link_set_preferred_link_settings. valid_input OR-style true if EITHER matches. dp_phy_settings_write 330 long param[3] NO init; 371-373 bounds check reads all 3 unconditionally; 405/407/409 write values to lane_settings. dp_phy_test_pattern_write does right: long param[11]={0x0} at 491. Comparison-side-channel info leak + confused-deputy HW misprogramming. Fix: param[N]={0}.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1765 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Initialize long param[2]={0,0}. | 463 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1765 — Verdict
Severity: Low Status: INCONCLUSIVE (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: none Confidence: certain
Verdict
INCONCLUSIVE. The cited bug is confirmed real in the audited source at sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:155.
Mechanism
DEAD CODE (CONFIG_DEBUG_FS). dp_link_settings_write declares long param[2] without initializer; 1-token input leaves param[1] uninit, switch reads it. Defense-in-depth fix.
Fix
Initialize long param[2]={0,0}.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- a
- m
- d
- g
- p
- u
- _
- d
- m
- /
- a
- m
- d
- g
- p
- u
- _
- d
- m
- _
- d
- e
- b
- u
- g
- f
- s
- .
- c
- :
- 1
- 5
- 5
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:155. Dead code. Fix compiled clean.
PoC changes
authored fix.diff: initialize param[2]={0,0}
Verified recommended fix
Initialize param array. Defense-in-depth for dead code.
Verdict
INCONCLUSIVE - DEAD CODE (CONFIG_DEBUG_FS). long param[2] without initializer; switch reads uninit param[1].
No comments yet.