Summary

radeon_dp_work_func L98-109 computes mode_config=&dev->mode_config L103 then list_for_each_entry(connector,&mode_config->connector_list,head) L107 with NO mutex_lock(&mode_config->mutex). Inline comment L106 (this should take a mutex) is authors own acknowledgment. Sibling radeon_hotplug_work_func L90 correctly takes same lock. drm_mode_config_cleanup (radeon_display.c:1657) walks+frees connector_list under mutex; unlocked worker can race. Concurrent MST topology change add/remove connector also races. Local user display access can trigger DP IRQ + MST change concurrently. Outcome: list corruption/UAF panic. r600_audio_update_hdmi r600_hdmi.c:132 equivalent defect for encoder_list. Fix: mutex_lock(mode_config->mutex) around walk mirroring hotplug_work_func.

PoC verification

Evidence pack

findings/poc/DF-1878 · 4 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited bug	577 B	view raw
VERDICT.md	verdict	source-confirmation analysis	1.0 KB	↓ raw
build.sh	build-script	N/A (source-only)	65 B	view raw
run.sh	run-script	N/A (source-only)	89 B	view raw

VERDICT.md verdict source-confirmation analysis

↓ download raw

DF-1878 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: radeon_dp_work_func L98-109 computes mode_config=&dev->mode_config L103 then list_for_each_entry(connector,&mode_config->connector_list,head) L107 with NO mutex_lock(&mode_config->mutex). Inline comme

Citation: sys/dev/drm/radeon/radeon_irq_kms.c:98-108

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: radeon_dp_work_func walks connector_list without mutex (radeon_irq_kms.c:98-108)

Verified recommended fix

Source-confirmed: radeon_dp_work_func walks connector_list without mutex (radeon_irq_kms.c:98-108)

Verdict