Summary

get_mfd_cell_dev L172 dev=bus_find_device_by_name(&platform_bus_type,NULL,auto_dev_name) returns NULL when no matching platform device. L173 dev_info(dev,...) immediately derefs dev -> dev_printk reads dev->... no NULL check. Callers propagate NULL: acp_hw_init L347 pm_genpd_add_device acp_hw_fini L455 pm_genpd_remove_device both deref dev. TOCTOU: mfd_add_hotplug_devices L340 enqueues creation async then L345-352 walks names assuming exist. Root can unbind cell between init/fini forces fini-time NULL. Fix: NULL check before dev_info propagate error to caller. [PASS-2 REACHABILITY: dead TU - not built, unbuildable, config-gated off; unreachable at runtime, see findings/poc/DF-4826/]

PoC verification

Evidence pack

findings/poc/DF-1908 · 4 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited bug	512 B	view raw
VERDICT.md	verdict	source-confirmation analysis	1.0 KB	↓ raw
build.sh	build-script	N/A (source-only)	65 B	view raw
run.sh	run-script	N/A (source-only)	89 B	view raw

VERDICT.md verdict source-confirmation analysis

↓ download raw

DF-1908 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: get_mfd_cell_dev L172 dev=bus_find_device_by_name(&platform_bus_type,NULL,auto_dev_name) returns NULL when no matching platform device. L173 dev_info(dev,...) immediately derefs dev -> dev_printk read

Citation: sys/dev/drm/amd/amdgpu/amdgpu_acp.c:165-176

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: get_mfd_cell_dev derefs NULL dev via dev_info (amdgpu_acp.c:165-176)

Verified recommended fix

Source-confirmed: get_mfd_cell_dev derefs NULL dev via dev_info (amdgpu_acp.c:165-176)

Verdict