NULL deref of adev->pdev->bus->self in cik_pcie_gen3_enable/cik_program_aspm on root-bus CIK GPUs (upstream pci_is_root_bus guard #if 0'd out)
Summary
The DFly port disabled the upstream pci_is_root_bus() early-returns with #if 0 (no such compat fn) and never replaced them; both functions then dereference the upstream bridge pointer. On a discrete CIK GPU attached directly to the root complex (server platforms, VMs with GPU passthrough) bus->self == NULL -> amdgpu attach panics. Siblings vi.c/soc15.c carry the same dead #if 0 but never dereference root. Hardware-gated boot DoS. Explicit NULL-check fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4150 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 231 B | ↓ raw | |
| verdict.json | file | 1.1 KB | view raw |
DF-4150 — cik.c root-bus NULL deref
Upstream pci_is_root_bus guards #if 0'd; no replacement NULL check for pdev->bus->self before :1417/:1630. Root-bus CIK topologies panic at attach. Hardware-gated. PoC skipped per contract.
Fix verification
not_testablereplace the disabled pci_is_root_bus guards with explicit 'if (adev->pdev->bus->self == NULL) return;' in both functions
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
cik.c:1379 root = pdev->bus->self used at :1417/:1630; the #if 0 guard sites 1385-1388/1549-1552 have no replacement
Verdict
source-verified; hardware-gated (no CIK asic on audit guest)
No comments yet.