DF-4215 — dc construct() OOM failure path dereferences NULL current_state / NULL ctx in destruct() → probe-time panic

• File: sys/dev/drm/amd/display/dc/core/dc.c
• Lines: 519–538 (destruct), 569–620 (construct allocs + goto fail), 686–689
• Class: NULL pointer dereference on error path (CWE-476/CWE-755)
• Hardware gate: AMD GPU (amdgpu DC core); trigger = allocation failure during dc_create()

Root cause

construct() performs six kzallocs in sequence (bw_dceip 569, bw_vbios 577, dcn_soc 585, dcn_ip 593, dc_ctx 602, current_state = dc_create_state() 615). Every failure does goto fail → destruct(dc) (686–689). But destruct() unconditionally dereferences the very things that may not exist yet:

static void destruct(struct dc *dc)
{
    dc_release_state(dc->current_state);       /* 521: NULL if 615 failed */
    ...
    if (dc->ctx->gpio_service)                 /* 528: NULL ctx if 602 failed */
        dal_gpio_service_destroy(&dc->ctx->gpio_service);
    if (dc->ctx->i2caux)                       /* 531 */
    ...

• If the dc_ctx allocation (602–606) fails, dc->ctx == NULL — yet 521 runs first: dc_release_state(NULL) → kref_put(&context->refcount, …) (dc.c:1103-1106) reads through the NULL pointer → page-fault panic.
• If dc_create_state() fails (615–620), dc->current_state == NULL → same panic at 521.
• Even if current_state were guarded, dc->ctx->gpio_service (528), dc->ctx->i2caux (531), dc->ctx->created_bios (534), kfree(dc->ctx) (537) all deref a possibly-NULL dc->ctx.

dc_create() (729–775) then propagates: construct_fail: kfree(dc); return NULL — so with the guards in place the driver degrades gracefully to "Display Core failed to initialize" (amdgpu_dm.c:440-444); without them, a single failed kzalloc during GPU probe panics the kernel.

Note ASSERT_CRITICAL/ASSERT are WARN_ON-only in this tree (os_types.h:59-77), so nothing else arrests the path first.

Verification status

untested — hardware-gated (guest's only GPU is the bochs VGA 1234:1111, env.txt; amdgpu DC never initializes, and an OOM at exactly this probe window would additionally be needed). Source-certain.

Fix

fix.diff: NULL-guard dc->current_state and every dc->ctx deref in destruct().

VERDICT — DF-4215

status: untested (hardware-gated) · impact: panic (probe-time, OOM-gated) · confidence: certain (source)

Not reproducible on the audit guest: no AMD GPU (env.txt — only bochs 1234:1111), so dc_create()/construct() never execute; the trigger further requires one of six kzallocs to fail during probe.

Source proof: - construct() order: dceip (569) → vbios (577) → dcn_soc (585) → dcn_ip (593) → ctx (602) → current_state (615); every failure goto fail → destruct(dc) (dc.c:686-689). - destruct() line 521: dc_release_state(dc->current_state) with current_state == NULL when 615-620 failed, or when any earlier alloc failed (kzalloc'd dc still zero) → kref_put(&context->refcount, …) (dc.c:1103-1106) is an inline read at NULL+offset → page fault. - Even bypassing that, dc->ctx may be NULL (602-606 failure) and is deref'd at 528/531/534/537. - ASSERT/ASSERT_CRITICAL are WARN_ON-only (os_types.h:59-77) — no backstop.

Deterministic NULL-deref, but gated on OOM during GPU probe → Low severity. Fix is defensive guards; not runtime-validated (no hardware) → fix_status: not_testable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.