radeon_bios: kmalloc-NULL-deref ordering in radeon_acpi_vfct_bios - memcpy before NULL check
Summary
radeon_acpi_vfct_bios 717: rdev->bios=kmalloc(ImageLength,M_DRM,M_WAITOK); 718: memcpy(rdev->bios,...,ImageLength); 719: ret=!!rdev->bios. NULL check AFTER memcpy that derefs pointer. M_WAITOK can return NULL under extreme pressure or pathological size. Adjacent radeon_read_bios(98-102) and igp_read_bios_from_vram(68-72) both check NULL BEFORE memcpy. Malicious VFCT with huge ImageLength -> alloc fails -> memcpy derefs NULL -> panic. Fix: reorder NULL check before memcpy.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1785 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add NULL check between kmalloc and memcpy. | 400 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1785 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/radeon/radeon_bios.c:717-719.
Mechanism
radeon_acpi_vfct_bios kmallocs rdev->bios then memcpy(rdev->bios,...) before the NULL check; if kmalloc returns NULL under pathological size, memcpy derefs NULL.
Fix
Add NULL check between kmalloc and memcpy.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
radeon sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- r
- a
- d
- e
- o
- n
- /
- r
- a
- d
- e
- o
- n
- _
- b
- i
- o
- s
- .
- c
- :
- 7
- 1
- 7
- -
- 7
- 1
- 9
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/radeon/radeon_bios.c:717-719. Fix compiled clean.
PoC changes
authored fix.diff: NULL check between kmalloc and memcpy
Verified recommended fix
Add NULL check between kmalloc and memcpy. Matches finding proposal.
Verdict
REPRODUCED (source-only). memcpy(rdev->bios,...) before NULL check; pathological size kmalloc fail -> memcpy(NULL) panic.
No comments yet.