amdgpu_i2c_get_byte() leaves *val uninitialized on failed transfers; router-select helpers then compute with and print the garbage byte
Summary
*val assigned only on ret==2; both router helpers declare u8 val uninit then use it - on DF's compat stub the failure branch runs on EVERY call. Live-demonstrated in the DF-4961 run (4x uninit val printed). Minor dmesg disclosure + wrong mux state. *val=0 fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4962 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.1 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
bit i2c (always-fail on DF stub) -> *val untouched -> val &= ~pin | state -> written to router + printed
Evidence (decisive lines)
findings/poc/DF-4962/ (this verdict; live log in the DF-4961 pack)
Verdict
Live-demonstrated during the DF-4961 fix-validation run (findings/poc/DF-4961/run.2.log: the failure branch executed 4x with the uninitialized val printed as the second %02x): amdgpu_i2c_get_byte leaves val untouched unless i2c_transfer()==2, and both router-select helpers declare u8 val uninitialized then compute/print it - on DF's compat stub the failure branch is taken on EVERY call, so a garbage stack byte propagates into router-mux writes and debug logs. Minor info disclosure into dmesg + wrong mux state. val=0-before-transfer fix.
No comments yet.