radeon_dp_mst: uninitialized kernel stack byte read in radeon_dp_mst_probe when AUX transfer fails
Summary
radeon_dp_mst_probe at 676 u8 msg[1] uninitialized. drm_dp_dpcd_read throw-away DPCD_REV read at drm_dp_helper.c:306 fails -> goto out leaves buffer untouched -> returns negative error. if(ret) at 689 true for negative. msg[0]&DP_MST_CAP at 690 reads uninitialized stack byte. Malicious/failing MST hub/dongle on DCE5+ radeon. Fix: msg[1]={0}; if(ret==1).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1776 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Initialize msg[1]={0} and check ret==1 instead of if(ret). | 622 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1776 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: leak:1 Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/radeon/radeon_dp_mst.c:676,689-690.
Mechanism
radeon_dp_mst_probe declares u8 msg[1] uninitialized; if drm_dp_dpcd_read fails (negative ret), if(ret) is true, msg[0] reads uninitialized stack byte.
Fix
Initialize msg[1]={0} and check ret==1 instead of if(ret).
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
radeon sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- r
- a
- d
- e
- o
- n
- /
- r
- a
- d
- e
- o
- n
- _
- d
- p
- _
- m
- s
- t
- .
- c
- :
- 6
- 7
- 6
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- r
- a
- d
- e
- o
- n
- /
- r
- a
- d
- e
- o
- n
- _
- d
- p
- _
- m
- s
- t
- .
- c
- :
- 6
- 8
- 9
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/radeon/radeon_dp_mst.c:676,689. Fix compiled clean.
PoC changes
authored fix.diff: init msg={0} + check ret==1
Verified recommended fix
Initialize msg buffer; check ret==1 not if(ret). Matches finding proposal.
Verdict
REPRODUCED (source-only). u8 msg[1] uninitialized; if dpcd_read fails (negative), if(ret) true, msg[0] reads uninit stack.
No comments yet.