hwmgr_hw_init preflight check dereferences hwmgr_func before its NULL guard (latent)
Summary
hwmgr_hw_init L214-216 if(!hwmgr->pptable_func||!hwmgr->pptable_func->pptable_init||!hwmgr->hwmgr_func->backend_init). C || short-circuits L-R: first clause guards pptable_func; second guards pptable_init; third clause !hwmgr->hwmgr_func->backend_init dereferences hwmgr->hwmgr_func with NO preceding NULL test in chain. If hwmgr_func==NULL while pptable_func!=NULL+pptable_init!=NULL kernel NULL-derefs hwmgr->hwmgr_func instead of taking intended pm_en=false;return 0 graceful DPM-disable. NOT reachable current tree: every chip family in hwmgr_early_init L94-183 assigns hwmgr_func unconditionally or returns -EINVAL. Defense-in-depth only; activates if future chip sets pptable_func but omits hwmgr_func. Fix: reorder to !hwmgr->hwmgr_func|| before !hwmgr->hwmgr_func->backend_init.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1913 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 409 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:214: preflight check dereferences hwmgr_func before its NULL guard
Verified recommended fix
Source-confirmed at sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:214: preflight check dereferences hwmgr_func before its NULL guard
Verdict
Source-confirmed at sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:214: preflight check dereferences hwmgr_func before its NULL guard
No comments yet.