hwmgr_hw_fini dereferences hwmgr->hwmgr_func->backend_fini and hwmgr->pptable_func->pptable_fini guarded only by pm_en — no PHM_FUNC_CHECK-style preflight (same latent class as DF-1913 at unguarded sites)
Summary
hw_fini checks only !hwmgr||!pm_en then raw-derefs both table pointers while every phm_* helper alongside is protected; latent (every chip path assigns both tables or aborts). Mirror-the-preflight fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4831 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 889 B | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
none in-tree (requires a future chip path leaving a table NULL with pm_en true, then unload/reset NULL-derefs)
Evidence (decisive lines)
findings/poc/DF-4831/ (this verdict)
Verdict
Latent hardening (DF-1913 family, distinct sites): hwmgr_hw_fini checks only !hwmgr||!pm_en then derefs hwmgr->hwmgr_func->backend_fini and pptable_func->pptable_fini with no NULL test - while every phm_* helper alongside is PHM_FUNC_CHECK-protected and hw_init preflights both pointers. Latent because every chip path in hwmgr_early_init assigns both tables or aborts the probe (verified for CI/CZ/AI/RV/VI). Mirror-the-preflight one-line fix.
No comments yet.