pp_get_current_clocks dereferences hwmgr->current_ps without the NULL guard its siblings have — NULL-deref panic after a failed pp_table reset, triggered via unprivileged DC modeset
Summary
The function checks only !hwmgr || !pm_en and then dereferences current_ps->hardware - while its two siblings explicitly NULL-check. The poisoning path: a pp_table sysfs write (non-overflowing but INVALID content - distinct from DF-1560) fails the re-parse during reset, leaving current_ps freed-and-NULL while dpm_enabled stays true (set only in hw_init, never cleared on failure). The next unprivileged display reconfiguration (dm_pp_get_static_clocks from any modeset) panics. One-line sibling-guard fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4368 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 156 B | ↓ raw | |
| verdict.json | file | 884 B | view raw |
DF-4368
Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: add the sibling '!hwmgr->current_ps' guard
Fix verification
not_testableadd the sibling '!hwmgr->current_ps' guard
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; full path:line trace in pass-2 result block
Verdict
source-verified; hardware-gated (no AMD GPU on audit guest)
No comments yet.