intel_dsi_vbt: NULL-deref on vbt.lfp_lvds_vbt_mode in intel_dsi_vbt_init
Summary
intel_dsi_vbt_init at 508 mode=dev_priv->vbt.lfp_lvds_vbt_mode. 544 pclk=mode->clock derefs unconditionally. lfp_lvds_vbt_mode only set when parse_lfp_panel_data finds BOTH BDB_LVDS_LFP_DATA and BDB_LVDS_LFP_DATA_PTRS (intel_bios.c:262-280). DSI presence determined independently by child device entries. VBT with MIPI child device + valid BDB_MIPI_CONFIG but missing LFP data -> parse_mipi_config succeeds -> reaches intel_dsi_vbt_init with mode==NULL -> NULL deref panic at 544. Fix: NULL guard at top of intel_dsi_vbt_init.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1773 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add NULL guard for mode at the top of intel_dsi_vbt_init. | 355 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1773 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/i915/intel_dsi_vbt.c:508,544.
Mechanism
intel_dsi_vbt_init derefs mode->clock where mode=vbt.lfp_lvds_vbt_mode which can be NULL if LFP data is missing; DSI presence is independent, causing NULL deref panic.
Fix
Add NULL guard for mode at the top of intel_dsi_vbt_init.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
i915 sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- i
- 9
- 1
- 5
- /
- i
- n
- t
- e
- l
- _
- d
- s
- i
- _
- v
- b
- t
- .
- c
- :
- 5
- 0
- 8
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- i
- 9
- 1
- 5
- /
- i
- n
- t
- e
- l
- _
- d
- s
- i
- _
- v
- b
- t
- .
- c
- :
- 5
- 4
- 4
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/i915/intel_dsi_vbt.c:508,544. Fix compiled clean.
PoC changes
authored fix.diff: NULL guard for mode at top of init (corrected to target intel_dsi_vbt_init not mipi_exec_send_packet)
Verified recommended fix
Add NULL guard for mode at function entry. Matches finding proposal.
Verdict
REPRODUCED (source-only). mode->clock derefed unconditionally; mode can be NULL if LFP data missing, NULL deref panic.
No comments yet.