DF-3995 — VERDICT

Finding: dc_link_is_dp_sink_present() destroys a DDC pin object it does not own — use-after-free on every later DDC/AUX transaction plus double free at connector/link teardown.

Status: reproduced (verbatim-code ownership-chain harness; live-hardware trigger not possible on the QEMU guest — no AMD GPU). Confidence: certain (code defect), likely (in-field triggerability).

Root cause (path:line)

• sys/dev/drm/amd/display/dc/core/dc_link.c:348 — ddc = dal_ddc_service_get_ddc_pin(link->ddc); returns a borrowed pointer. The object is owned by link->ddc (struct ddc_service), created once in core/dc_link_ddc.c:272 (ddc_service->ddc_pin = dal_gpio_create_ddc(...)) and is supposed to be destroyed only by the owner in dal_ddc_service_destroy → destruct (dc_link_ddc.c:306-307).
• sys/dev/drm/amd/display/dc/core/dc_link.c:360-365 — on dal_ddc_open(ddc, GPIO_MODE_INPUT, GPIO_DDC_CONFIG_TYPE_MODE_I2C) failure the code calls dal_gpio_destroy_ddc(&ddc), which (gpio/gpio_service.c:459-471) destroys pin_data, pin_clock, kfrees the struct ddc, and nulls only the local variable — while ddc_service->ddc_pin still points at the freed memory.

Consequences

1. Use-after-free: every later use of the connector's DDC service dereferences ddc_service->ddc_pin: - dc_link_is_dp_sink_present itself on the next hotplug/detect (dc_link.c:360 → dal_ddc_open(freed->pin_data)); - get_ddc_line (dc_link.c:969 → dal_ddc_get_line); - every DDC/AUX submission: core/dc_link_ddc.c:643-656 reads ddc->ddc_pin->pin_data->en to select the AUX engine (freed-memory read; in-kernel: garbage engine index / res_pool->engines[...] OOB or fault).
2. Double free: at link destruction destruct(ddc_service) (dc_link_ddc.c:306-307) calls dal_gpio_destroy_ddc(&ddc->ddc_pin) on the already-freed object: it reads pin_data/pin_clock out of freed heap and kfrees those stale pointers — an uncontrolled double free / arbitrary-free-shaped primitive, plus kfree of the already-freed ddc.

Trigger / threat model

dal_ddc_open fails when either DDC gpio is already open — e.g. while an AUX/I2C engine transaction holds the pins (dal_gpio_open_ex returns GPIO_RESULT_ALREADY_OPENED when gpio->pin != NULL, gpio_base.c:59-67). The engines open the same struct ddc in different modes (i2caux/aux_engine.c:82, i2caux/i2c_hw_engine.c:190, i2caux/i2c_sw_engine.c:468, dce/dce_aux.c:883, dce/dce_i2c_hw.c:376, dce/dce_i2c_sw.c:386). HPD-driven detect (userspace DRM ioctls: DRM_IOCTL_MODE_GETCONNECTOR / hotplug events) races MST/link-loss AUX traffic on the same connector; a malicious or flaky DP sink (the threat model already established by DF-1319/DF-3987/DF-3988) can stall AUX transactions (defer/NACK timeouts hold the pins open longer), widening the window. A single occurrence permanently corrupts the connector's DDC service.

Reproduction

• Guest: DragonFly 6.5-DEVELOPMENT (see env.txt) — no AMD GPU present (pciconf shows no amdgpu device), so a live kernel trigger cannot be run on this guest.
• ddc_uaf_harness.c reproduces the exact ownership chain with the verbatim destroy logic; with an injected dal_ddc_open failure it shows (run.log): the borrowed free, the DANGLING ddc_service->ddc_pin, the UAF read on the next AUX transaction, and the owner-destroy dereference of freed memory. Exit code 2. Deterministic across runs (run.2/run.3 logs).

Exploit chain (post-trigger, on real hardware)

free(struct ddc + 2×struct gpio) → subsequent AUX/DPCD traffic UAF-writes gpio open state through freed pointers → object placement (the ~24-byte ddc and the kmalloc'd struct gpio sit in small-object slabs contended by attacker-influenced drm allocations) allows reclamation; teardown then kfrees stale pointers read from reclaimed memory (arbitrary-free shape). On the standard no-hardening target this is a privesc-grade primitive; full chain is hardware-gated and not demonstrated here.

Fix

fix.diff — remove the dal_gpio_destroy_ddc(&ddc) call at dc_link.c:362 (the caller does not own ddc). Fix-validated with ddc_uaf_harness_fixed.c: patched chain exits 0, ddc_pin stays live until owner destroy, 4 allocs / 4 frees balanced (fix_run.log).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.