Summary

construct() unconditionally dereferences return values of dc_create_gamma() and dc_create_transfer_func() both of which explicitly return NULL on kzalloc failure. construct() at dc_surface.c:42 plane_state->gamma_correction=dc_create_gamma() then :43 plane_state->gamma_correction->is_identity=true NULL deref if line 42 returned NULL. Similarly :45 dc_create_transfer_func() then :46 plane_state->in_transfer_func->type=TF_TYPE_BYPASS NULL deref. Neither return value checked. Contrast destruct() (49-59) which DOES NULL-check both fields before releasing proving author knew these could be NULL. construct() returns void so dc_create_plane_state cannot propagate failure. Reachable from unprivileged user via DRM atomic-commit plane-add path: amdgpu_dm.c:5463 dc_create_plane_state(dc) from amdgpu_dm_atomic_commit (DRM_IOCTL_MODE_ATOMIC). Trigger: attacker creates memory pressure (mmap+touch large anon regions/memfd_create/fork bomb) then performs DRM operation adding a plane. kzalloc(sizeof(struct dc_gamma)) or kzalloc(sizeof(struct dc_transfer_func)) fails. construct() derefs NULL kernel panics. A:H total system crash. No privilege escalation no info leak reliable local DoS. structs are small few KB so sustained OOM sufficient.