⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1878

radeon_dp_work_func walks connector_list without mode_config mutex (acknowledged in source)

Summary

radeon_dp_work_func L98-109 computes mode_config=&dev->mode_config L103 then list_for_each_entry(connector,&mode_config->connector_list,head) L107 with NO mutex_lock(&mode_config->mutex). Inline comment L106 (this should take a mutex) is authors own acknowledgment. Sibling radeon_hotplug_work_func L90 correctly takes same lock. drm_mode_config_cleanup (radeon_display.c:1657) walks+frees connector_list under mutex; unlocked worker can race. Concurrent MST topology change add/remove connector also races. Local user display access can trigger DP IRQ + MST change concurrently. Outcome: list corruption/UAF panic. r600_audio_update_hdmi r600_hdmi.c:132 equivalent defect for encoder_list. Fix: mutex_lock(mode_config->mutex) around walk mirroring hotplug_work_func.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1878 · 4 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able fix for the cited bug 577 B view raw
VERDICT.md verdict source-confirmation analysis 714 B ↓ raw
build.sh build-script N/A (source-only) 61 B view raw
run.sh run-script N/A (source-only) 87 B view raw
VERDICT.md verdict source-confirmation analysis
↓ download raw

DF-1878 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: radeon_dp_work_func L98-109 computes mode_config=&dev->mode_config L103 then list_for_each_entry(connector,&mode_config->connector_list,head) L107 with NO mutex_lock(&mode_config->mutex). Inline comme

Citation: sys/dev/drm/radeon/radeon_irq_kms.c:98-108

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: radeon_dp_work_func walks connector_list without mutex (radeon_irq_kms.c:98-108)

Verified recommended fix

Source-confirmed: radeon_dp_work_func walks connector_list without mutex (radeon_irq_kms.c:98-108)

Verdict

Source-confirmed: radeon_dp_work_func walks connector_list without mutex (radeon_irq_kms.c:98-108)