Ignored DPCD-read failures feed uninitialized stack into PSR/training-interval/dongle-quirk decisions; read_hpd_rx_irq_data uses a shared 'static' retval across links
Summary
core_link_read_dpcd returns DC_ERROR_UNEXPECTED leaving the caller's buffer untouched on failure; dc_link_dp.c ignores the result and consumes uninitialized stack locals (training_rd_interval, psr_configuration, dp_id, dp_hw_fw_revision, sink_id). Consumers are comparison-only (memcmp/strncmp dongle quirks) - no userspace disclosure; impact is garbage-driven workaround toggles and delays. Also a shared 'static retval' across all links/threads in read_hpd_rx_irq_data. Fix: zero-init + check returns + drop static.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3992 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 299 B | ↓ raw | |
| verdict.json | file | 1.0 KB | view raw |
DF-3992 — dc_link_dp.c ignored DPCD failures (uninit stack) + shared static retval
Low/hardening. PoC skipped per contract (Low severity). Sources cited in pass-2 result; fix: zero-initialize the read unions, honor core_link_read_dpcd returns, remove 'static' from retval at dc_link_dp.c:1649.
Fix verification
not_testablehardening fix: zero-init locals, check core_link_read_dpcd returns, drop 'static' from retval
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source citations dc_link_dp.c:50,1649,1710,2254,2275,2338,2345 in the pass-2 result block
Verdict
source-verified; runtime verification skipped (Low severity, hardware-gated)
No comments yet.