DF-4839 — BUG_ON panic in drm_primary_helper_update on enabled connector-less CRTC

• File: sys/dev/drm/drm_plane_helper.c:265
• Severity: Info (hardening) — Confidence: speculative
• Class: kernel panic / DoS via BUG_ON (CWE-617 reachable assert)
• Reach: unprivileged DRM master on radeon/amdgpu/dce (drm_crtc_init users) via DRM_IOCTL_MODE_SETPLANE, provided the CRTC was left enabled with zero encoder-bound connectors (e.g. after a failed legacy modeset — the DF-4469 family documents how the fail path corrupts connector->encoder bindings).

Build / Run

No PoC exists: the audit guest has no DRM device (QEMU std-VGA only; /dev/dri* and /dev/drm* do not exist), so DRM_IOCTL_MODE_SETPLANE is not issuable. Verification was static-only; see VERDICT.md for the full line-cited trace. On hardware the trigger would be:

/* drm master fd; primary plane id P of an enabled-but-connectorless CRTC */
struct drm_mode_set_plane req = { .plane_id = P, .fb_id = F, .crtc_id = C,
    .crtc_x=0,.crtc_y=0,.crtc_w=w,.crtc_h=h,
    .src_x=0,.src_y=0,.src_w=w<<16,.src_h=h<<16 };
ioctl(fd, DRM_IOCTL_MODE_SETPLANE, &req);   /* -> BUG_ON -> panic */

Expected on vulnerable setup: kernel panic "kernel: BUG_ON ... num_connectors". Expected with fix.diff: clean -EINVAL.

Fix

fix.diff — replace BUG_ON with an error return (upstream-equivalent hardening).

DF-4839 — BUG_ON(num_connectors == 0) in drm_primary_helper_update() — Info / speculative (static-only)

Claim

drm_primary_helper_update() (sys/dev/drm/drm_plane_helper.c:215-288) is the default update_plane handler for the helper-created primary planes of every driver that registers CRTCs with drm_crtc_init() — in this tree that is radeon (radeon_display.c), amdgpu (dce_v8_0.c, dce_v10_0.c, dce_v11_0.c, dce_virtual.c), and any module using the transitional KPI. It is reached from the unprivileged-DRM-master DRM_IOCTL_MODE_SETPLANE path:

drm_mode_setplane()                     drm_plane.c:774
  setplane_internal()                   drm_plane.c:735   (all modeset locks held)
  __setplane_internal()                 drm_plane.c:647
    plane->funcs->update_plane == drm_primary_helper_update   drm_plane.c:690
      drm_plane_helper_check_update()   drm_plane_helper.c:246  (visible == true
                                    requires crtc->enabled, drm_atomic_helper.c:766-770)
      get_connectors_for_crtc(crtc,NULL,0)                    drm_plane_helper.c:264
      BUG_ON(num_connectors == 0);                            drm_plane_helper.c:265   <-- panic

get_connectors_for_crtc() (drm_plane_helper.c:73-101) counts connectors via connector->encoder && connector->encoder->crtc == crtc. The BUG_ON fires whenever crtc->enabled == true (checked moments earlier through the crtc_state.enable built at drm_plane_helper.c:156-160) but no connector is currently encoder-bound to that CRTC.

Why this is only Info/speculative

On a correctly-functioning driver an enabled CRTC always has >= 1 bound connector (the legacy set_config path refuses to enable a CRTC with zero connectors), so the BUG_ON cannot be reached by well-formed ioctls alone. However the corrupt state is exactly what the already-filed DF-4469 (drm_crtc_helper.c racy save_connector_encoders sizing → OOB write into connector->encoder on the fail path) and the fail-path encoder-unbind behavior documented around DF-4470/DF-4471 can produce: an enabled CRTC left with zero live connector bindings after a failed modeset. A second SetPlane ioctl on that CRTC's primary plane then converts the latent inconsistency into a hard kernel panic (BUG_ON) — a one-syscall local DoS for a DRM master.

Upstream evolution supports treating this as hardening rather than a bug fix: this transitional-helper path (and its BUG_ON) has no surviving modern-kernel equivalent; the whole primary-helper update path was retired as drivers moved to atomic. Keeping a BUG_ON on a state invariant that the core's own fail paths can violate is defense-in-depth debt.

Disposition

• Not reproduced live: the audit QEMU guest has no DRM device (ls /dev/dri* /dev/drm* → ENOENT; only vgapci0 QEMU std-VGA, no drm driver attaches), so no SetPlane ioctl can be issued at all. Static trace only.
• Severity Info, confidence speculative (needs DF-4469-class state corruption as setup, or any driver defect leaving an enabled connector-less CRTC).
• Fix: return -EINVAL instead of BUG_ON (see fix.diff). Trivially safe; no kernel-build validation performed because there is no reproduction baseline on this guest (fix_status: not_applicable).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.