β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-1913

hwmgr_hw_init preflight check dereferences hwmgr_func before its NULL guard (latent)

Summary

hwmgr_hw_init L214-216 if(!hwmgr->pptable_func||!hwmgr->pptable_func->pptable_init||!hwmgr->hwmgr_func->backend_init). C || short-circuits L-R: first clause guards pptable_func; second guards pptable_init; third clause !hwmgr->hwmgr_func->backend_init dereferences hwmgr->hwmgr_func with NO preceding NULL test in chain. If hwmgr_func==NULL while pptable_func!=NULL+pptable_init!=NULL kernel NULL-derefs hwmgr->hwmgr_func instead of taking intended pm_en=false;return 0 graceful DPM-disable. NOT reachable current tree: every chip family in hwmgr_early_init L94-183 assigns hwmgr_func unconditionally or returns -EINVAL. Defense-in-depth only; activates if future chip sets pptable_func but omits hwmgr_func. Fix: reorder to !hwmgr->hwmgr_func|| before !hwmgr->hwmgr_func->backend_init.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1913 Β· 1 files
FileTypeDescriptionSize
manifest.json file 409 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:214: preflight check dereferences hwmgr_func before its NULL guard

Verified recommended fix

Source-confirmed at sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:214: preflight check dereferences hwmgr_func before its NULL guard

Verdict

Source-confirmed at sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:214: preflight check dereferences hwmgr_func before its NULL guard