DF-4493 — rs780_dpm.c: NULL boot_ps / skipped state parse → NULL-deref page-fault panic

What

Two ways to reach a NULL rdev->pm.dpm.boot_ps (or NULL ps_priv) that the DPM enable path dereferences without any check:

1. No BOOT-classified state (rs780_dpm.c:741-742 sets boot_ps only when rps->class & ATOM_PPLIB_CLASSIFICATION_BOOT). A PowerPlayInfo table whose non-clock infos lack the BOOT bit parses "successfully" (rs780_parse_power_table() returns 0, :843), leaving boot_ps == NULL. radeon_pm_init_dpm() (radeon_pm.c:1448) discards the dpm_init return, sets current_ps = requested_ps = boot_ps (:1449) and calls radeon_dpm_enable() (:1453) → rs780_dpm_enable() fetches boot_ps (:600) and passes it to rs780_initialize_dpm_parameters() (:608) → rs780_initialize_dpm_power_state() does default_state = rs780_get_ps(boot_ps) (:78) → NULL->ps_priv read at address 0x28 → page-fault panic.

2. ucStateEntrySize == 1: the guard if (power_info->pplib.ucStateEntrySize - 1) (:822) is false, so NO state is parsed at all — every ps[i].ps_priv stays NULL and boot_ps is never set — yet num_ps = ucNumStates is still assigned (:842) and the function returns success. Any later rs780_get_ps() consumer derefs NULL: rs780_dpm_print_power_state() (:946 ps->sclk_low, address 0x8), rs780_dpm_set_power_state() (:567-568), rs780_dpm_get_sclk() (:965-970), rs780_dpm_force_performance_level() (:1031).

Family: DF-4187 (sumo), DF-4124 (rv6xx), DF-4143 (trinity), DF-4118 (cypress) — rs780 is the last sibling with the same shape.

Reproduce

./build.sh
./run.sh            # modes 4493 (no BOOT state) and 4493b (ucStateEntrySize==1)

Expected baseline (run.log):

• mode 4493: boot_ps=0x0 then *** SIGNAL 11 at address 0x28 ***, exit=99
• mode 4493b: ps[0].ps_priv=0x0 then *** SIGNAL 11 at address 0x8 ***, exit=99

Expected with harness_fixed: mode 4493 prints DRM_ERROR: no boot power state, refusing to enable DPM (enable guard), mode 4493b rejects the table at parse (invalid state entry size 1), both exit=0.

Kernel-level reproduction is hardware-gated (no RS780 IGP in the QEMU guest); the harness is a verbatim replica — see VERDICT.md.

Fix

fix.diff (in this directory): rs780_dpm_enable() refuses to run without a boot power state, and the parse rejects ucStateEntrySize < 2 (an ATOM_PPLIB_STATE is 2 bytes). Validated: radeon.ko builds under -Werror after applying the fix to the guest's /usr/src (radeon_module_build.log, MAKE_RC=0).

DF-4493 — VERDICT

Finding: NULL boot_ps / never-parsed states (ucStateEntrySize == 1 or missing BOOT classification) → NULL-pointer page-fault panic in the rs780 DPM enable/print paths.

Status: REPRODUCED at logic level (verbatim replica), 2 attempts. Kernel-level trigger hardware-gated (no RS780/RS880 IGP in the QEMU guest); family precedent DF-4187/DF-4124/DF-4143/DF-4118 verified identically.

Reachability chain (all cited)

1. radeon_pm_init_dpm() — radeon_dpm_init(rdev); at radeon_pm.c:1448 is a bare statement: the return value of rs780_dpm_init() is discarded, so parse "success" is not even required — but in these two scenarios the parse genuinely returns 0 (rs780_dpm.c:843).
2. radeon_pm.c:1449 current_ps = requested_ps = boot_ps (NULL).
3. radeon_pm.c:1453 radeon_dpm_enable(rdev) → rs780_dpm.c:600 boot_ps = rdev->pm.dpm.boot_ps (NULL) → :608 rs780_initialize_dpm_parameters(rdev, NULL) → :78 rs780_get_ps(NULL) → rps->ps_priv load from NULL+40 (0x28).

Variant B (ucStateEntrySize == 1): rs780_dpm.c:822 if (power_info->pplib.ucStateEntrySize - 1) evaluates 1 - 1 == 0 → the entire per-state parse (kzalloc igp_ps, ps_priv attach, boot_ps assignment at :741-742) is skipped, while :842 still sets num_ps = ucNumStates and the function returns 0. Consumers then deref the NULL ps_priv: rs780_dpm_print_power_state() :946 (ps->sclk_low, NULL+8), rs780_dpm_set_power_state() :567-568, rs780_dpm_get_sclk() :965-970, rs780_dpm_force_performance_level() :1031.

Observed (run.log)

===== mode 4493 =====
rs780_parse_power_table() = 0 num_ps=1 boot_ps=0x0
calling rs780_dpm_enable() with boot_ps == NULL ...
*** SIGNAL 11 at address 0x28: SIGSEGV ... (kernel: page-fault PANIC) ***
exit=99

===== mode 4493b =====
rs780_parse_power_table() = 0 num_ps=1 boot_ps=0x0 ps[0].ps_priv=0x0
radeon_dpm_print_power_states() walks 1 states whose ps_priv are NULL ...
*** SIGNAL 11 at address 0x8: SIGSEGV ... ***
exit=99

Address 0x28 is exactly offsetof(struct radeon_ps, ps_priv) (verified in the harness against the kernel layout radeon.h:1342-1357); address 0x8 is offsetof(struct igp_ps, sclk_low) (rs780_dpm.h:52-58). The harness is compiled with -fno-delete-null-pointer-checks — the same semantics the kernel relies on — so the loads trap instead of being folded away.

Fix validation

fix.diff: (a) rs780_dpm_enable() returns -EINVAL when boot_ps == NULL; (b) parse rejects ucStateEntrySize < 2. Fixed harness:

DRM_ERROR: no boot power state, refusing to enable DPM
rs780_dpm_enable() returned -22 - NO CRASH (fix active)   exit=0
DRM_ERROR: invalid state entry size 1
rs780_parse_power_table() = -22 ... crafted table rejected   exit=0

Applied to the guest /usr/src: radeon_fix_apply.log (7 hunks), radeon_module_build.log — radeon.ko links under -Werror, MAKE_RC=0. Guest source reverted (md5 verified) and guest reset afterwards.

Attempts

1. First run showed "NO CRASH": the userspace stub's dead outputs let GCC eliminate the NULL loads (UB folding). Fixed by compiling with -fno-delete-null-pointer-checks and feeding the loaded sclk into a volatile sink — restoring kernel trap semantics.
2. Decisive run in run.log.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.