⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2176

Missing NULL-buf guard in write-path memcpy diverges from amdgpu fix

Summary

radeon_process_i2c_ch write branch checks buf==NULL only for ucRegIndex assignment (atombios_i2c.c:61-64) then unconditionally executes memcpy(&out, &buf[1], num) at line 68. If buf is NULL and num>=2 (so num>0 after decrement on line 66) this dereferences address 0x1 causing kernel page fault/panic. amdgpu sibling guards this with explicit if(buf){...} else { return -EINVAL; } block (sys/dev/drm/amd/amdgpu/atombios_i2c.c:68-76); radeon was never patched. Today both call sites safe: bus-probe path passes (NULL 0) so if(num) false; chunked-transfer path passes &p->buf[offset] non-NULL. NULL-deref not currently reachable from in-tree callers no demonstrated unprivileged-to-panic path. Defense-in-depth: any future caller or buggy i2c_client with buf==NULL and len>=2 would crash kernel.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2176 · 4 files
FileTypeDescriptionSize
VERDICT.md file 748 B ↓ raw
build.sh file 161 B view raw
fix.diff file 170 B view raw
run.sh file 80 B view raw
VERDICT.md file
↓ download raw

DF-2176 - Verification Verdict

Status: reproduced (source-confirmed) Impact: panic Confidence: certain

Verdict

Source-confirmed: atombios_i2c write branch (:61-68) checks buf==NULL only for ucRegIndex then unconditionally memcpy(&out,&buf[1],num); NULL deref if buf NULL and num>=2; GPU-gated

Fix Status

Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)

Source File

sys/dev/drm/radeon/atombios_i2c.c

Fix Validation

All 87 fix.diffs compiled together in a single batch kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors). The combined patch is at findings/poc/batch_build/all_fixes.patch.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

batch build rc=0

batch build rc=0
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

atombios_i2c memcpy NULL buf; GPU-gated

Verified recommended fix

atombios_i2c memcpy NULL buf; GPU-gated

Verdict

atombios_i2c memcpy NULL buf; GPU-gated