radeon_dp_mst: unbounded goto-loop in check_status enables HPD workqueue DoS via malicious hub
Summary
radeon_dp_mst_check_status loops via goto go_again (736) while ESI re-read returns 8 bytes and drm_dp_mst_hpd_irq handled=true. No iteration cap. Malicious hub strobes ESI bits continuously. Pins HPD work item blocking all other hot-plug. Physical/compromised-dock. Fix: cap iterations at 8.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1778 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Cap iterations at 8 in the go_again loop. | 768 B | view raw |
| VERDICT.md | verdict | full analysis | 1.0 KB | ↓ raw |
DF-1778 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: dos Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/radeon/radeon_dp_mst.c:736.
Mechanism
radeon_dp_mst_check_status loops via goto go_again with no iteration cap; malicious hub strobes ESI bits continuously, pinning HPD work item.
Fix
Cap iterations at 8 in the go_again loop.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
radeon sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- r
- a
- d
- e
- o
- n
- /
- r
- a
- d
- e
- o
- n
- _
- d
- p
- _
- m
- s
- t
- .
- c
- :
- 7
- 3
- 6
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/radeon/radeon_dp_mst.c:736. Fix compiled clean.
PoC changes
authored fix.diff: cap iterations at 8 (restructured break to conditional goto for scope)
Verified recommended fix
Cap go_again iterations at 8. Matches finding proposal.
Verdict
REPRODUCED (source-only). check_status loops goto go_again with no cap; malicious hub strobes ESI continuously, pins HPD work.
No comments yet.