DF-3651 — NULL-pointer dereference of rdev->pm.dpm.dyn_state.cac_tdp_table when the VBIOS has no PowerTune table: five unchecked sinks in ci_dpm.c

File: sys/dev/drm/radeon/ci_dpm.c (pass 2, GLM 5.3 re-audit) Severity: Medium | CWE-476 NULL Pointer Dereference | confidence: certain

Reproduce

No harness: the defect is a NULL/UAF control-flow property (source-level certainty); the kernel path needs CI-class hardware absent from the guest — see env.txt.

(source review only; see VERDICT.md)

Full narrative: VERDICT.md. Proposed fix: fix.diff (authored against the read-only sys/ tree; never applied there).

DF-3651 — verdict narrative

Finding

NULL-pointer dereference of rdev->pm.dpm.dyn_state.cac_tdp_table when the VBIOS has no PowerTune table: five unchecked sinks in ci_dpm.c

Kernel references

• sys/dev/drm/radeon/ci_dpm.c:244
• sys/dev/drm/radeon/ci_dpm.c:330
• sys/dev/drm/radeon/ci_dpm.c:414
• sys/dev/drm/radeon/ci_dpm.c:435
• sys/dev/drm/radeon/ci_dpm.c:666
• sys/dev/drm/radeon/ci_dpm.c:748
• sys/dev/drm/radeon/r600_dpm.c:1257
• sys/dev/drm/radeon/r600_dpm.c:1261

Was it reproduced?

No — not on the kernel path. The audit guest is virtio-only (0 AMD PCI devices, /dev/dri absent, no radeon/drm kld; env.txt), so sys/dev/drm/radeon/ci_dpm.c can never execute there. Per the pass-2 instruction for this hardware-gated file, the verdict is inconclusive (source-level certainty certain) rather than reproduced.

Root cause and reasoning

Source-certain NULL deref family. cac_tdp_table is heap-allocated only when the VBIOS extended header (>= V7) carries usPowerTuneTableOffset (r600_dpm.c:1257-1265); otherwise rdev->pm.dpm.dyn_state.cac_tdp_table stays NULL (rdev is zero-allocated). pi->caps_power_containment is nevertheless set true unconditionally (ci_dpm.c:244,251), so ci_dpm_enable unconditionally reaches: ci_populate_bapm_parameters_in_dpm_table -> cac_tdp_table->tdp/configurable_tdp (ci_dpm.c:435-436, called from ci_init_smc_table:3677), ci_populate_tdc_limit -> ->tdc (330), ci_populate_bapm_vddc_base_leakage_sidd -> high/low_cac_leakage (414-415), ci_enable_power_containment -> maximum_power_delivery_limit (666), and ci_power_control_set_level -> configurable_tdp (748). None is NULL-checked; a crafted VBIOS (or simply an early/trimmed PowerTune-less extended header) deterministically panics the kernel at radeon DPM enable. First sink hit in program order is ci_dpm.c:435 during the first ci_init_smc_table. Kernel path unreachable on this GPU-less guest; inconclusive overall.

Exploitability

Crafted VBIOS without a PowerTune table (extended header size < V7 or usPowerTuneTableOffset == 0) on a CI-class card -> NULL+offset kernel read at ci_init_smc_table time -> boot/attach panic. DoS only.

Recommended fix

NULL-check rdev->pm.dpm.dyn_state.cac_tdp_table (return -EINVAL / skip) at the five deref sites in ci_dpm.c. See fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.