DF-4312 — dcn10_link_encoder_create OOB const-register-table indexing

What: sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:744-746 indexes three 4-entry const register tables with values parsed from the GPU's object tables (VBIOS / atombios firmware) with no bounds validation:

&link_enc_regs[enc_init_data->transmitter]           /* 4 entries */
&link_enc_aux_regs[enc_init_data->channel - 1]       /* 4 entries */
&link_enc_hpd_regs[enc_init_data->hpd_source]        /* 4 entries */

Value domains actually producible in-tree (dc_link.c):

transmitter = translate_encoder_to_transmitter() [dc_link.c:1008+] -1 TRANSMITTER_UNKNOWN (default/unknown enum ids) -> index -1 4 TRANSMITTER_UNIPHY_E (ENCODER_ID_INTERNAL_UNIPHY2/ENUM_ID_1) 5 TRANSMITTER_UNIPHY_F (ENCODER_ID_INTERNAL_UNIPHY2/ENUM_ID_2) 6 TRANSMITTER_NUTMEG_CRT (external encoder, VBIOS-declared) 7 TRANSMITTER_TRAVIS_CRT 8 TRANSMITTER_TRAVIS_LCD 9 TRANSMITTER_UNIPHY_G (ENCODER_ID_INTERNAL_UNIPHY3) -> all of { -1, 4..9 } are out of bounds for the 4-entry array

channel = get_ddc_line() [dc_link.c:966+] 0 CHANNEL_ID_UNKNOWN (ddc NULL / unknown GPIO_DDC_LINE) -> index -1 5..8 CHANNEL_ID_DDC5/DDC6/DDC_VGA/I2C_PAD -> indices 4..7 OOB

hpd_source = get_hpd_line() [dc_link.c:1007+] 4,5 HPD_SOURCEID5/6 (valid enum values on other ASICs) 6 HPD_SOURCEID_UNKNOWN (grph_object_defs.h:53, returned when no HPD gpio maps to the connector) -> indices 4,5,6 OOB for the 4-entry array

Impact: out-of-bounds read of kernel .rodata/.data yields a bogus struct dcn10_link_enc_registers * (and aux/hpd equivalents) which is stored in the link encoder and dereferenced for every subsequent register access (dcn10_link_encoder.c REG_UPDATE/REG_READ via these bases) -> wild MMIO reads/writes at attacker-chosen (VBIOS-chosen) offsets: MMIO writes to arbitrary offsets within/near the GPU's register aperture, at minimum a boot-time GPU bring-up failure / hang / machine check; the register-table pointer is not exposed to userspace, so no direct info leak.

Threat model: the indices come from the GPU's own firmware (VBIOS object tables). Exploitation requires a crafted / foreign VBIOS on a Raven-class DCN1 APU (e.g. flashed GPU, resale-supply-chain, or a buggy VBIOS declaring an external TRAVIS/NUTMEG encoder or DDC5/HPD5 line) - the same trust boundary as DF-4216 (dc_submit_i2c unvalidated DDC index, filed Low). Severity Low for that reason.

Reachability on this audit guest: NOT reachable - the guest is QEMU std-VGA with zero AMD/ATI PCI devices (pciconf -l | grep -ci "amd\|ati" = 0, see env.txt); dcn10_create_resource_pool() is only invoked when amdgpu.ko attaches to a DCN1 (Raven) ASIC. PoC therefore not executable on the available hardware: verdict inconclusive (code-certain defect, hardware-gated trigger).

Files: ANALYSIS.md the full index-domain table and call graph (this text) fix.diff bounds check in dcn10_link_encoder_create (git-apply clean) env.txt guest evidence of hardware absence verdict.json machine verdict

Suggested manual test on real hardware (for maintainers with a Raven APU): amdgpu.debug_mask / patched atombios declaring a TRAVIS external encoder on connector 0, or hpd_source=HPD_SOURCEID5: pre-fix kernel logs bogus encoder MMIO / hangs in link encoder init; post-fix dcn10_link_encoder_create returns NULL and dc_link_construct fails gracefully (dc_link.c:1188 link_enc_create_fail).

VERDICT — DF-4312 dcn10_link_encoder_create unvalidated VBIOS-derived indices

STATUS: inconclusive (code-certain defect; trigger hardware-gated, absent from the audit guest) REPRODUCED: 0 (no AMD GPU in guest; dcn10 pool construction requires amdgpu attach to a DCN1/Raven ASIC)

ANALYSIS CONFIRMATION (static, line-accurate):

1. dcn10_resource.c:744-746 - the three table index expressions, arrays sized 4 (dcn10_resource.c:309-314 link_enc_regs, 284-289 link_enc_aux_regs, 296-301 link_enc_hpd_regs). No bounds checks exist anywhere between dc_link.c filling enc_init_data and these lookups.

2. dc_link.c:1176-1184 fills the struct: enc_init_data.channel = get_ddc_line(link); enc_init_data.hpd_source = get_hpd_line(link); enc_init_data.transmitter = translate_encoder_to_transmitter(enc_init_data.encoder); with bp_funcs->get_src_obj() (atombios parser) supplying the encoder object - i.e. all three originate in the GPU VBIOS.

3. Enum domains (grph_object_defs.h:81-92, :58-68, :45-54; dc_link.c translate_encoder_to_transmitter/get_ddc_line/get_hpd_line bodies): transmitter can be -1 (UNKNOWN) or 4..9 (UNIPHY_E/F, NUTMEG_CRT, TRAVIS_CRT/LCD, UNIPHY_G); channel 0 (UNKNOWN) or 5..8 (DDC5/6/VGA/ I2C_PAD -> idx 4..7); hpd_source 4..6 (HPD5/6, HPD_SOURCEID_UNKNOWN=6). Every one of those values indexes outside the 4-entry tables.

4. The resulting out-of-bounds const struct ..._registers * is stored in the constructed encoder (dcn10_link_encoder_construct) and used as the base for all later REG_* MMIO in dcn10_link_encoder.c / dcn10_stream_encoder.c - i.e. wild MMIO at VBIOS-chosen offsets, not a userspace-readable leak.

Why Low: attacker must control GPU firmware (same boundary as DF-4216, rated Low). No unprivileged or remote path exists.

Why not guest-testable: guest has no AMD PCI device at all (env.txt); amdgpu.ko never probes; dcn10_create_resource_pool is unreachable.

Fix: one bounds check in dcn10_link_encoder_create returning NULL on out-of-range indices (fix.diff; git apply --check clean against sys/; ARRAY_SIZE already used in this compilation unit's sibling dcn10_stream_encoder.c). The NULL return is already handled gracefully by dc_link.c:1186-1190 (link_enc_create_fail path).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.