DF-4352 — dce110_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source (DF-4312/4319 twin)

Build / Run (guest model)

cc -O2 -Wall -o df4352 df4352.c
./df4352

Expected: CONST-TABLE OOB READ CONFIRMED (model) — 9 of 28 reachable enum values index out of bounds: - link_enc_regs[transmitter] (7 entries): TRANSMITTER_UNKNOWN(-1), TRAVIS_CRT(7), TRAVIS_LCD(8), UNIPHY_G(9) - link_enc_aux_regs[channel-1] (6 entries): CHANNEL_ID_UNKNOWN(0)→[-1], DDC_VGA(7)→[6], I2C_PAD(8)→[7] - link_enc_hpd_regs[hpd_source] (6 entries): COUNT(6), UNKNOWN(7)

Root cause

dce110_resource.c:588-590 performs the three lookups with values sourced at link bring-up from the VBIOS object tables (dc_link.c:1177-1183 — get_ddc_line, get_hpd_line, translate_encoder_to_transmitter, each with UNKNOWN defaults) and no bounds checks. An OOB const read yields a garbage register-offset struct that becomes the encoder's MMIO base for every later register access — VBIOS-steerable wild MMIO. Trust boundary identical to DF-4216/DF-4312/DF-4319 (crafted/foreign VBIOS).

Fix

fix.diff (git apply --check clean): bounds-check all three and return NULL — the caller (dc_link.c:1187-1190) already fails the link cleanly on NULL.

DF-4352 VERDICT

Status: untested (kernel path) — code defect certain; guest model enumerates every reachable OOB index.

Root cause (line-accurate)

dce110_link_encoder_create (sys/dev/drm/amd/display/dc/dce110/ dce110_resource.c:576-592):

588:  &link_enc_regs[enc_init_data->transmitter],      /* 7 entries :259-267 */
589:  &link_enc_aux_regs[enc_init_data->channel - 1],  /* 6 entries :230-237 */
590:  &link_enc_hpd_regs[enc_init_data->hpd_source]    /* 6 entries :244-251 */

The three indices are VBIOS-derived, filled in dc_link.c at link construct:

• transmitter — translate_encoder_to_transmitter (dc_link.c:1006-1024+) returns TRANSMITTER_UNKNOWN (-1) for unrecognized encoder ids, and external/NUTMEG/TRAvis encoders and UNIPHY_G map to 6..9 (grph_object_defs.h:81-94). Table domain: 0..6.
• channel — get_ddc_line (dc_link.c:964-1004) returns CHANNEL_ID_UNKNOWN (0) by default, CHANNEL_ID_DDC_VGA (7) and CHANNEL_ID_I2C_PAD (8) explicitly. With the - 1 shift at :589 the reachable indices are -1, 6, 7 against a 6-entry table (grph_object_defs.h:58-69).
• hpd_source — get_hpd_line (dc_link.c:925-962) returns HPD_SOURCEID_UNKNOWN (7) when no HPD gpio exists; COUNT=6. Both are OOB against the 6-entry table (grph_object_defs.h:45-55).

None of the three is validated anywhere on the path. The OOB read produces a struct dce110_link_enc_registers-shaped blob of adjacent .rodata which dce110_link_encoder_construct stores; every subsequent register access on that encoder dereferences offsets from it as MMIO addresses — VBIOS-chosen wild MMIO (bring-up hang / machine check at minimum, wrong-hardware register pokes at worst). No userspace-readable leak.

Twin of DF-4312 (dcn10, 4-entry tables) and DF-4319 (dce80) — same family, different file, different table sizes and a -1 shift unique to the channel lookup.

Verification

• Kernel path untestable on the audit guest: pciconf (root) lists only i440FX/PIIX + virtio devices — no AMD GPU, amdgpu unbindable (env.txt).
• Guest model df4352.c (cc 8.3; build.log/run.log) replicates the three tables (7/6/6) and the three verbatim index expressions over the real enum domains: 9 of 28 reachable values index OOB, including -1 twice.

Fix validation

Kernel-level validation impossible on this guest. fix.diff (git apply --check clean) bounds-checks all three values and returns NULL; the caller dc_link.c:1187-1190 already handles NULL by failing this link's creation cleanly (link_enc_create_fail).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.