• File: sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
• Lines: 346–348 (deref via aconnector->mst_encoder->base)
• Severity: Low
• CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
• CWE: CWE-476 NULL Pointer Dereference
• Confidence: certain
• Status: new

Summary

dm_dp_add_mst_connector() stores the result of dm_dp_create_fake_mst_encoder() without NULL-checking it, then computes &aconnector->mst_encoder->base and hands that address to drm_connector_attach_encoder, which unconditionally dereferences encoder->base.id. dm_dp_create_fake_mst_encoder returns NULL on kzalloc failure (line 291–293), so under memory pressure this path collapses into a kernel NULL-deref panic during connector bring-up.

Root cause

In sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c:346-348:

346  aconnector->mst_encoder = dm_dp_create_fake_mst_encoder(master);
347  drm_connector_attach_encoder(&aconnector->base,
348                   &aconnector->mst_encoder->base);

dm_dp_create_fake_mst_encoder (lines 283–308) does:

291  amgpu_encoder = kzalloc(sizeof(*amdgpu_encoder), GFP_KERNEL);
292  if (!amdgpu_encoder)
293      return NULL;

On memory pressure the function returns NULL, mst_encoder is set to NULL, and the next statement evaluates &aconnector->mst_encoder->base. struct amdgpu_encoder (sys/dev/drm/amd/amdgpu/amdgpu_mode.h:462-463) begins with struct drm_encoder base; as its FIRST field, so offsetof is 0 and &((struct amdgpu_encoder *)NULL)->base == NULL.

drm_connector_attach_encoder (sys/dev/drm/drm_connector.c:310-336) reaches connector->encoder_ids[i] = encoder->base.id; at drm_connector.c:331, dereferencing the NULL encoder pointer → fatal page fault.

Threat model

Attacker position: local unprivileged user on a system where amdgpu is in active use AND the kernel is under sufficient memory pressure to fail a sizeof(struct amdgpu_encoder) (a few hundred bytes) GFP_KERNEL allocation.

Practically, this means running the system to OOM or fragmenting the GFP_KERNEL slab while MST topology changes are in flight (unplug/replug an MST hub during heavy memory load).

Required privilege: none beyond the ability to cause memory pressure (any local user can fork-bomb or amass slab caches).

Required config: amdgpu loaded, an MST-capable connector.

Impact: kernel NULL-deref panic → reboot. Confidentiality/Integrity: none.

Lower practical severity than the EDID bug (DF-1966) because it requires the kernel to be unable to satisfy a small GFP_KERNEL allocation at the exact instant an MST port is being added — but it is a deterministic panic on that condition, and the fix is trivial.

Proof of concept

Prereq: amdgpu with an MST-capable DP connector present (any modern AMD APU/dGPU with DP or USB-C DP-alt-mode).

Force the system toward GFP_KERNEL exhaustion:

for i in $(seq 1 4096); do dd if=/dev/zero of=/tmp/fill.$i bs=1M count=256 & done

(or a tiny fork/alloc bomb) while simultaneously cycling an attached MST hub:

while true; do
    xrandr --output DP-1 --off
    sleep 0.1
    xrandr --output DP-1 --auto
    sleep 0.1
done

Each topology rebuild on the master connector queues dm_dp_add_mst_connector for each discovered child port; when one of those invocations races with an OOM, kzalloc in dm_dp_create_fake_mst_encoder returns NULL and the next instruction takes the page fault.

Expected result: panic in dm_dp_add_mst_connector → drm_connector_attach_encoder with fault address near 0.

Recommended fix

Check the return of dm_dp_create_fake_mst_encoder and roll back the partially-initialized connector (which has already been drm_connector_init'd) before returning NULL to the topology manager.

--- a/sys/dev/drm/amd/display/amgpu_dm/amdgpu_dm_mst_types.c
+++ b/sys/dev/drm/amd/display/amgpu_dm/amdgpu_dm_mst_types.c
@@ -343,6 +343,12 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
    amdgpu_dm_connector_init_helper(
        &adev->dm, aconnector, DRM_MODE_CONNECTOR_DisplayPort,
        master->dc_link, master->connector_id);
+
+   aconnector->mst_encoder = dm_dp_create_fake_mst_encoder(master);
+   if (!aconnector->mst_encoder) {
+       DRM_ERROR("amdgpu_dm: failed to allocate MST encoder\n");
+       drm_connector_cleanup(connector);
+       kfree(aconnector);
+       return NULL;
+   }

-   aconnector->mst_encoder = dm_dp_create_fake_mst_encoder(master);
    drm_connector_attach_encoder(&aconnector->base,
                    &aconnector->mst_encoder->base);

This unblocks the NULL deref at drm_connector.c:331 and surfaces the failure to the MST topology manager, which already handles NULL returns from this callback.

References

• sys/dev/drm/amd/display/amgpu_dm/amdgpu_dm_mst_types.c:346-348 — the buggy deref
• sys/dev/drm/amd/display/amgpu_dm/amdgpu_dm_mst_types.c:283-308 — dm_dp_create_fake_mst_encoder returns NULL on kzalloc failure
• sys/dev/drm/drm_connector.c:310-336 — drm_connector_attach_encoder derefs encoder->base.id
• sys/dev/drm/amd/amdgpu/amdgpu_mode.h:462-463 — struct amdgpu_encoder begins with struct drm_encoder base;