intel_dsi_vbt: NULL-deref on dsi_hosts[port] in mipi_exec_send_packet
Summary
mipi_exec_send_packet at 127 seq_port=(flags>>MIPI_PORT_SHIFT)&3 reads 2 bits from attacker VBT flags. 134-137 if(ports==BIT(PORT_C)) port=PORT_C else port=intel_dsi_seq_port_to_port(seq_port) maps non-zero to PORT_C. 139 dsi_device=intel_dsi->dsi_hosts[port]->device derefs host. Check at 140 only guards dsi_device NOT host. Single-link PORT_A panel dsi_hosts[PORT_C]==NULL (vlv_dsi.c:1806-1814 only alloc ports in ->ports kzalloc at 1755). Crafted VBT SEND_PKT flags bit 3 set. Trigger: display enable. NULL deref panic. Fix: validate dsi_hosts[port]!=NULL and ports&BIT(port).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1770 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Validate dsi_hosts[port]!=NULL before deref. | 493 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1770 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/i915/intel_dsi_vbt.c:134-140.
Mechanism
mipi_exec_send_packet derefs intel_dsi->dsi_hosts[port] without NULL check; single-link PORT_A panel has dsi_hosts[PORT_C]==NULL, crafted VBT SEND_PKT triggers NULL deref panic.
Fix
Validate dsi_hosts[port]!=NULL before deref.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
i915 sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- i
- 9
- 1
- 5
- /
- i
- n
- t
- e
- l
- _
- d
- s
- i
- _
- v
- b
- t
- .
- c
- :
- 1
- 3
- 4
- -
- 1
- 4
- 0
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/i915/intel_dsi_vbt.c:134-140. Fix compiled clean.
PoC changes
authored fix.diff: validate dsi_hosts[port]!=NULL before deref
Verified recommended fix
Add NULL check for dsi_hosts[port]. Matches finding proposal.
Verdict
REPRODUCED (source-only). dsi_hosts[port] derefed without NULL check; single-link PORT_A has NULL host, crafted VBT triggers NULL deref.
No comments yet.