DF-3809 — port_to_transcoder[PORT_F] out-of-bounds read on GEN9_BC (SKL/KBL/CFL) DDI F

File

sys/dev/drm/i915/intel_ddi.c:3180-3187 (intel_enable_ddi_hdmi, Display WA #1143)

Build / Run / Expected

Not built, not run — guest has no Intel graphics (DragonFly QEMU guest: std VGA, no i915/drm0 attachment — see env.txt). Source-level finding.

Hypothetical trigger on affected hardware: boot a GEN9_BC part (SKL/KBL/CFL, IS_GEN9_BC() = IS_GEN9() && !IS_LP(), i915_drv.h:2562) whose SFUSE_STRAP reports SFUSE_STRAP_DDIF_DETECTED (i915_reg.h:9664) and whose VBT declares port F DP/HDMI/DVI capable, then userspace enables an HDMI mode on that port (any modeset via drm ioctls). Expected: port_to_transcoder[5] reads past the 5-element array.

Root cause

The WA #1143 lookup table covers PORT_A..PORT_E only:

static const enum transcoder port_to_transcoder[] = {
        [PORT_A] = TRANSCODER_EDP,
        [PORT_B] = TRANSCODER_A,
        [PORT_C] = TRANSCODER_B,
        [PORT_D] = TRANSCODER_C,
        [PORT_E] = TRANSCODER_A,
};
enum transcoder transcoder = port_to_transcoder[port];   /* port == PORT_F == 5 -> OOB */

intel_display.c:14340-14341 constructs PORT_F DDI encoders inside the HAS_DDI() branch (which includes all GEN9_BC parts) whenever the DDIF strap bit is set, and intel_ddi_init() completes for the port because every helper it uses (intel_port_to_power_domain, intel_ddi_max_lanes, intel_infoframe_init) handles PORT_F. Only this WA array does not. The OOB read lands in adjacent .rodata; the garbage transcoder value is then used to compute CHICKEN_TRANS(transcoder) — an MMIO write with an attacker-uncontrolled but out-of-range register offset (bits set then cleared).

Impact

Wrong-register MMIO writes during HDMI enable on DDI F of an affected part: display-state corruption / potential GPU hang. No proven control over the offset or data beyond two fixed bits. Severity: Low.

DF-3809 — VERDICT

status: untested (poc enum) / not testable on this guest — no Intel GPU.

What was verified (source-level)

1. The array has exactly 5 designated initializers, indices 0..4 (intel_ddi.c:3180-3186). port at the use site (intel_ddi.c:3187) is encoder->port, type enum port, values PORT_A=0 .. PORT_F=5 (checked: enum port in intel_drv.h includes PORT_F; I915_MAX_PORTS=6).
2. The enclosing block executes for every IS_GEN9_BC(dev_priv) HDMI enable (intel_ddi.c:3173) — SKL, KBL, CFL per i915_drv.h:2562.
3. PORT_F DDI encoders are created on the same platform family: intel_display.c:14317 (else if (HAS_DDI(dev_priv))) → 14340-14341 (SFUSE_STRAP_DDIF_DETECTED → intel_ddi_init(dev_priv, PORT_F)). intel_ddi_init itself has no port whitelist; VBT gating (ddi_port_info[PORT_F].supports_*) is the only filter (intel_ddi.c:3772-3774).
4. No other array/index guard exists between init and the WA site.

Why not run

The DragonFly QEMU guest exposes no Intel graphics device; the i915 module never attaches (env.txt). Even on real hardware, triggering requires the CPU DDIF strap + a VBT declaring port F on a GEN9_BC part — a configuration we could not confirm exists in the field. The code defect (5-entry array indexed by a value that is 5 on a reachable path) is certain; the hardware precondition is the open question, hence confidence likely, severity Low.

What a maintainer should check

Whether any shipping SKL/KBL/CFL SKU sets SFUSE_STRAP_DDIF_DETECTED with a VBT port-F child device. Upstream later replaced the array with enum transcoder transcoder = (enum transcoder) port; semantics — aligning with that removes the OOB read.

Fix

--- a/sys/dev/drm/i915/intel_ddi.c
+++ b/sys/dev/drm/i915/intel_ddi.c
@@ -3177,7 +3177,10 @@ static void intel_enable_ddi_hdmi(struct intel_encoder *encoder,
         * the bits affect a specific DDI port rather than
         * a specific transcoder.
         */
        static const enum transcoder port_to_transcoder[] = {
            [PORT_A] = TRANSCODER_EDP,
            [PORT_B] = TRANSCODER_A,
            [PORT_C] = TRANSCODER_B,
            [PORT_D] = TRANSCODER_C,
            [PORT_E] = TRANSCODER_A,
+           [PORT_F] = TRANSCODER_A,
        };
        enum transcoder transcoder = port_to_transcoder[port];

(PORT_F has no dedicated transcoder; TRANSCODER_A mirrors the PORT_E handling. Alternatively add a WARN_ON(port >= ARRAY_SIZE(port_to_transcoder)) guard.)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)