DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2211

Uninitialized res.clock field returned by value from amdgpu_afmt_acr()

Summary

On the odd-clock path of amdgpu_afmt_acr() struct amdgpu_afmt_acr res is declared without initializer and only its six n_*/cts_* fields are populated by amdgpu_afmt_calc_cts(). The clock field (u32 at amdgpu.h:1258) is never written yet the whole 28-byte struct is returned by value at line 104 so uninitialized u32 propagates to caller stack. No existing caller reads res.clock today (verified rg acr.clock across sys/ returns zero hits) so no live info-leak but function return-by-value contract is violated and any future reader would silently receive kernel-stack garbage. The predefined-table branch (line 96) is fully initialized and not affected. Trigger: local user with DRM modeset access or crafted EDID can drive odd pixel clock through dce_{v8,v10,v11}_0_afmt_update_ACR() into odd-clock branch causing 4 bytes uninitialized kernel stack copied into caller struct. Impact today: none all three DCE callers read only n_*/cts_* fields. Becomes info-leak (C:L) the moment any future code path reads acr.clock and exposes it.

Discussion (0)

No comments yet.