DF-4202 — unchecked drm_cvt_mode() NULL results (radeon DF-4035 twin)

File: sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:405-407, 459-460 (pass 2) Severity: Low (OOM-gated NULL deref panic in LVDS/eDP get_modes) Status: not reproduced at runtime — hardware-gated + OOM-gated; source-level certainty.

Root cause

drm_cvt_mode() returns NULL when its internal drm_mode_create() fails — kzalloc failure or drm_mode_object_add() IDR failure (drm_modes.c:66-80 and drm_modes.c:164-169: "If failure, we will return directly" NULL). Both amdgpu call sites dereference unconditionally:

/* amdgpu_connector_lcd_native_mode() */
mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay,
            60, true, false, false);            /* :405 */
mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;   /* :406 NULL deref */
DRM_DEBUG_KMS("... %s\n", mode->name);                          /* :407 */

/* amdgpu_connector_add_common_modes() — loops 17 common modes */
mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h,
            60, false, false, false);          /* :459 */
drm_mode_probed_add(connector, mode);                           /* :460 list_add(NULL) */

drm_mode_probed_add is list_add_tail(&mode->head, ...) — a write through NULL+offset.

Reach

amdgpu_connector_lvds_get_modes() (:668, :676) and amdgpu_connector_dp_get_modes() eDP/LVDS branch (:1251, :1259) — the no-EDID-modes fallback that every laptop panel without a usable EDID takes on every probe — under kernel memory exhaustion. 17+ allocation attempts per probe × repeated probes (poll + GETCONNECTOR) make the window real under memory pressure. Upstream Linux carries the identical unguarded code (radeon upstream added if (mode) guards for the same pattern).

Evidence

• trigger_df4202.c — hammer probe loop with optional memory-hog children (./trigger_df4202 oom); builds and runs on the guest (no DRM device there — env.txt).
• fix.diff — if (mode) guards at both sites; verified to apply cleanly to a pristine copy of the real file.

Fix

See fix.diff.

DF-4202 VERDICT — unchecked drm_cvt_mode() NULL derefs

Verdict: not reproduced at runtime (hardware-gated + OOM-gated); source-level certainty: certain. Impact if exercised: kernel NULL-deref panic (DoS) in the connector get_modes path.

Why certain at source level

• drm_cvt_mode() (drm_modes.c:143-169) returns NULL exactly when drm_mode_create() (drm_modes.c:66-80) returns NULL — kzalloc failure or drm_mode_object_add() (IDR) failure. The function's own doc comment states it "Returns NULL when no mode could be allocated."
• Site 1 (amdgpu_connector_lcd_native_mode, amdgpu_connectors.c:405-407): mode->type = ... writes through NULL immediately.
• Site 2 (amdgpu_connector_add_common_modes, :459-460): drm_mode_probed_add(connector, mode) is defined as list_add_tail(&mode->head, &connector->probed_modes) — a NULL+offset write.
• Both functions run from the LVDS/eDP no-EDID fallback on every connector probe (lvds_get_modes :668/:676, dp_get_modes :1251/:1259), i.e. the standard path for a laptop panel whose EDID read fails, and the common modes loop alone makes 17 consecutive mode allocations per probe.

Runtime attempt

trigger_df4202.c built cleanly (guest cc 8.3) and ran; the audit guest exposes no DRM device (/dev/dri absent, no AMD/ATI PCI devices — env.txt), so the amdgpu get_modes path cannot execute there. Deterministic reproduction needs an amdgpu LVDS/eDP machine driven into kernel memory exhaustion while probing — same OOM gating as the radeon twin DF-4035, which upstream fixed by adding the exact if (mode) guards this pack's fix.diff adds.

Fix validation

Not possible on this guest. fix.diff verified to apply cleanly to a pristine copy of the real file (cumulative with DF-4200/DF-4201 diffs).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.