DF-4103 — amdgpu atombios_encoders: unguarded enc_priv (NULL) dereferences in all DIG setup paths

File: sys/dev/drm/amd/amdgpu/atombios_encoders.c (pass 2) Class: NULL-pointer dereference (CWE-476) → kernel panic / NULL-page WRITE Hardware gate: AMD GPU (CIK/VI, DCE8/10/11 non-DC asics) with LCD-supporting UNIPHY encoder. Family: amdgpu twin of DF-3957 (radeon atombios_encoders, same code shape).

Build

Not buildable/runnable on the audit guest: the QEMU guest has no AMD GPU (pciconf -l: only Intel/QEMU devices; vgapci0 = bochs 1234:1111). Source-level certainty only. See VERDICT.md.

Run (would be, on hardware / with an emulated ATI ROM)

1. Craft a VBIOS image whose encoder table yields an UNIPHY encoder with ATOM_DEVICE_LCD_SUPPORT but with the LVDS_Info master data table absent (or with a master-table index of 0), so amdgpu_atombios_encoder_get_lcd_info() returns NULL (atombios_encoders.c:2081 if (amdgpu_atom_parse_data_header(...)) fails → returns NULL at 2205).
2. Boot / kldload amdgpu → dce_v10_0_hw_init (dce_v10_0.c:2829) → amdgpu_atombios_encoder_init_dig (atombios_encoders.c:1744) → amdgpu_atombios_encoder_setup_dig_transmitter(encoder, ATOM_TRANSMITTER_ACTION_INIT, 0, 0) (1758) → dig = amdgpu_encoder->enc_priv; (837) → int dig_encoder = dig->dig_encoder; (848) → NULL-page READ → kernel panic.

Expected

Fatal trap 12: page fault while in kernel mode at amdgpu_atombios_encoder_setup_dig_transmitter+0x... during amdgpu hw_init (or later, amdgpu_atombios_encoder_setup_dig NULL WRITE at offset of panel_mode on first DPMS-ON).

Artifacts

• VERDICT.md — full narrative with path:line trace
• verdict.json — machine verdict (status: untested, hardware absent on guest)
• fix.diff — add if (!dig) return; guards (mirrors the guard the file already has in amdgpu_atombios_encoder_set_backlight_level, :91-93)

DF-4103 VERDICT

Status: untested (hardware-gated — no AMD GPU on the audit guest; source-level certainty certain) Impact: kernel panic (NULL-page read at boot; NULL-page write on DPMS-ON). Not exploitable beyond DoS.

Root cause

For encoders carrying ATOM_DEVICE_LCD_SUPPORT, enc_priv is produced by amdgpu_atombios_encoder_get_lcd_info():

• dce_v8_0.c:3408, dce_v10_0.c:3520, dce_v11_0.c:3652: amdgpu_encoder->enc_priv = amdgpu_atombios_encoder_get_lcd_info(amdgpu_encoder);

That function (atombios_encoders.c:2069-2206) returns NULL when: 1. amdgpu_atom_parse_data_header(...LVDS_Info...) fails (atombios_encoders.c:2081) — i.e. the VBIOS master data table has no LVDS_Info entry — fully VBIOS-controlled; or 2. the kzalloc at 2085-2086 fails (OOM at boot).

For non-LCD digital encoders, enc_priv = amdgpu_atombios_encoder_get_dig_info() (dce_v10_0.c:3524/3528) also returns NULL on kzalloc failure (atombios_encoders.c:2212-2215).

Four sinks in this file dereference enc_priv with no NULL check:

(Contrast amdgpu_atombios_encoder_set_backlight_level :91-93, which does guard amdgpu_encoder->enc_priv — the guards were simply never added to the setup paths.)

Reachability

• Boot path (no user action): dce_v10_0_hw_init (dce_v10_0.c:2829) → amdgpu_atombios_encoder_init_dig (:1744) → unconditional setup_dig_transmitter(ATOM_TRANSMITTER_ACTION_INIT) for every UNIPHY encoder (:1754-1759) → :848 NULL read → panic during driver attach.
• Runtime path (mode set): dce_v10_0_encoder_funcs dpms helpers (dce_v10_0.c:3421/3431) → amdgpu_atombios_encoder_dpms (:1477) → setup_dig (:1397) → :1414 NULL write to the panel_mode offset.

Trigger: crafted/corrupt VBIOS on an LCD (laptop panel) system, or kzalloc failure at the wrong instant. Threat model identical to DF-1380/DF-3744 (root-flashed VBIOS or malicious PCIe device ROM). On DragonFly amd64 the NULL page is unmapped in kernel context → deterministic fatal trap. A NULL-page write at a small fixed offset is not exploitable for code execution on this platform (no mapping at 0).

Why untested

The single-tenant QEMU guest has no AMD GPU (pciconf -l shows only Intel/ QEMU devices; display is bochs 1234:1111 — see verdict.json notes/env). The amdgpu driver never probes. Both trigger paths are inside amdgpu attach/ modeset, so no in-guest reproduction is possible without the hardware. Traced the cited path line-by-line instead; conclusion: real defect, certain, panic-only impact.

Fix

Add NULL guards exactly where the backlight path already has one (atombios_encoders.c:91-93). See fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.