DF-4455
Unbounded MMIO spin in PLL atomic-update wait can wedge the DRM master permanently
Summary
radeon_pll_write_update/pll2 busy-wait on PPLL_ATOMIC_UPDATE_R with no iteration cap, unlike the sibling read-complete helpers capped at 10000. A wedged GPU (unpriv DRM-auth client induces lockup via CS, classic on pre-AVIVO) makes the master's next DPMS/modeset spin forever inside the ioctl while holding mode_config.mutex and the modeset locks - permanently blocking every subsequent modeset/cursor/page-flip. Hardware-state-dependent trigger, hence Low. Bound-both-loops fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4455 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 908 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: no radeon GPU on guest
fix in finding markdown
per-fix-DF-4455
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Unpriv DRM-auth client induces GPU lockup; master's next DPMS/modeset enters the spin. Bound-both-loops fix in finding markdown.
Verdict
not_run: no radeon GPU on guest; loop bodies provably unbounded (sibling helpers capped at 10000)
No comments yet.