⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2211

Uninitialized res.clock field returned by value from amdgpu_afmt_acr()

Summary

On the odd-clock path of amdgpu_afmt_acr() struct amdgpu_afmt_acr res is declared without initializer and only its six n_*/cts_* fields are populated by amdgpu_afmt_calc_cts(). The clock field (u32 at amdgpu.h:1258) is never written yet the whole 28-byte struct is returned by value at line 104 so uninitialized u32 propagates to caller stack. No existing caller reads res.clock today (verified rg acr.clock across sys/ returns zero hits) so no live info-leak but function return-by-value contract is violated and any future reader would silently receive kernel-stack garbage. The predefined-table branch (line 96) is fully initialized and not affected. Trigger: local user with DRM modeset access or crafted EDID can drive odd pixel clock through dce_{v8,v10,v11}_0_afmt_update_ACR() into odd-clock branch causing 4 bytes uninitialized kernel stack copied into caller struct. Impact today: none all three DCE callers read only n_*/cts_* fields. Becomes info-leak (C:L) the moment any future code path reads acr.clock and exposes it. [VERIFIED pass2: HW-gated no AMD GPU; odd-clock res.clock never set code-certain; fix compile-validated]

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2211 · 8 files
FileTypeDescriptionSize
VERDICT.md — 1.5 KB ↓ raw
README.md — 246 B ↓ raw
build.sh — 95 B view raw
run.sh — 49 B view raw
env.txt — 314 B view raw
manifest.json — 684 B view raw
verdict.json — 2.1 KB view raw
fix.diff — 386 B view raw
README.md
↓ download raw

DF-2211 evidence pack

  • finding: sys/dev/drm/amd/amdgpu/amdgpu_afmt.c (88-104)
  • verdict: not_reproduced (certain) - see VERDICT.md
  • source-only confirmation (no runtime PoC)
  • reproduce: build.sh / run.sh
  • fix.diff: present, git-apply-able
VERDICT.md
↓ download raw

DF-2211 - Verification Verdict

Status: not_reproduced Impact: none (hardening) Confidence: certain

Mechanism

amdgpu_afmt_acr declares struct amdgpu_afmt_acr res and, when the clock is not in the predefined table, fills only the six cts/n fields via amdgpu_afmt_calc_cts (lines 100-102); res.clock is never assigned and the struct is returned by value at line 104 with an uninitialized 4-byte field.

Verdict

NOT REPRODUCED (hardware/module-gated on this QEMU guest) - code-certain line-level confirmation in the read-only sys/ tree. Callers embed res in audio ELD/CTS setup (kernel-internal drm paths); the garbage byte quartet influences display audio timing metadata, it is not copied to userspace verbatim. AMD GPU hardware absent in the QEMU guest.

Threat / reachability

Requires the named hardware/module; see VERDICT.md.

Privilege escalation assessment

n/a (device-gated)

Fix

Set res.clock = clock before the calculated path (one line), matching the table entries which always carry clock.

Kernel references

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

not_testable

fix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier

batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
↓ fix.diffper-fix-DF-2211

Confirmed kernel references

Detail

Exploit chain

no escalation path (Info-tier hardening; see VERDICT.md)

Evidence (decisive lines)

VERDICT.md mechanism/verdict sections; fix.diff

PoC changes

none (source-only confirmation for this Info-tier item)

Verified recommended fix

Set res.clock = clock before the calculated path (one line), matching the table entries which always carry clock.

Verdict

NOT REPRODUCED (hardware/module-gated on this QEMU guest) - code-certain line-level confirmation in the read-only sys/ tree. Callers embed res in audio ELD/CTS setup (kernel-internal drm paths); the garbage byte quartet influences display audio timing metadata, it is not copied to userspace verbatim. AMD GPU hardware absent in the QEMU guest.