DF-5079 — dce120 vupdate entries carry no .src_id → dce110_vblank_set pipe-offset underflow (pipe_ctx[178])

File: sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:138-144 (wired at :82-85 to dce110_vblank_set) — DF-4933 (dce110) / DF-5055 (dce80) twin on the DCE120 table wiring.

Build (on the guest)

mkdir -p /root/df5079 && cp dce120_vupd.c build.sh run.sh /root/df5079/
sh /root/df5079/build.sh

Run (on the guest; run twice for determinism)

sh /root/df5079/run.sh     # -> run.log, run.2.log

Expected

• baseline (dce120_vupd_base):
• table check: vupdate1 src_id=0 ext_id=0 (macro initializes none, unlike vblank's 19..24); the "double-baked" note prints — even a correct VUPDATE remap underflows: (uint8_t)(VUPDATE1(72) − IRQ_TYPE_VBLANK(78)) = 250;
• controls: VBLANK1..6 arm pipes 0..5 through the REAL conversion path (to_dal maps the consecutive VLINE0 src ids 19..24 → VBLANK1..6);
• trigger: set(DC_IRQ_SOURCE_VUPDATE1) → to_dal_irq_source_dce110(0,0) → DC_IRQ_SOURCE_INVALID → uint8_t pipe_offset = 0 − 78 = 178 → pipe_ctx[178] far-OOB read on the MAX_PIPES=6 array (poisoned 0x5a mapping) → garbage tg → tg->funcs->arm_vert_intr(tg,2) wild indirect call → SIGBUS exit 138. Kernel equivalent: far-OOB read feeding a wild indirect call ⇒ panic; a groomed heap could in principle aim tg (not demonstrated — honest ceiling is a panic).
• fixed (-DFIX_DF5079, = fix.diff: pipe derived from the TABLE INDEX, provably 0..5 for both ranges + correct V_UPDATE src ids in the macro): all 12 VUPDATE/VBLANK sources arm pipes 0..5, exit 0.

Observed (guest, cc 8.3): baseline exit=138 x2, fixed exit=0 x2 (dmesg.txt corroborates: pid ... (dce120_vupd_base) ... exited on signal 10).

Fix validation: same combined amdgpu.ko rebuild as DF-5078 (rc=0, 0/0 under -Werror; irq_service_dce110.c hunk = DF-4933/DF-5055's identical fix shape); sources reverted md5-verified pristine; make clean.

Reachability is latent (traced in VERDICT.md) and the guest has no AMD GPU — family-standard logic-level replica methodology.

DF-5079 VERDICT — dce120 vupdate entries (no .src_id) → dce110_vblank_set pipe_ctx[178] OOB, replica-reproduced

Status: reproduced (logic level, family-standard replica), impact panic, confidence certain. DF-4933 (dce110) / DF-5055 (dce80) twin wired independently by the DCE120 table's own macros.

Root cause (code-certain)

• vupdate_int_entry (irq_service_dce120.c:138-144) initializes IRQ_REG_ENTRY(...) + .funcs = &vblank_irq_info_funcs — and no .src_id/.ext_id (struct irq_service.h:46-57 has both fields; the entries therefore carry {src_id=0, ext_id=0}).
• vblank_irq_info_funcs (irq_service_dce120.c:82-85) wires .set = dce110_vblank_set.
• dce110_vblank_set (irq_service_dce110.c:195-219) re-derives the source from the table entry: dc_interrupt_to_irq_source(dc, info->src_id=0, info->ext_id=0) → to_dal_irq_source_dce110(0,0) (dce110:315-393) hits the default case → DC_IRQ_SOURCE_INVALID (0); then uint8_t pipe_offset = dal_irq_src - IRQ_TYPE_VBLANK (dce110:205) = (uint8_t)(0 - 78) = 178; then core_dc->current_state->res_ctx.pipe_ctx[178].stream_res.tg (dce110:207-208) — a far-OOB read on the MAX_PIPES=6 array (core_types.h:239-241, hw_shared.h:37) — and the very next statement calls through the garbage pointer: tg->funcs->arm_vert_intr(tg, 2) (dce110:210-211).
• Double-baked upstream: even a correctly remapped VUPDATE source underflows (VUPDATE1=72 − 78 → 250), because the subtraction base is IRQ_TYPE_VBLANK, not IRQ_TYPE_VUPDATE (printed by the replica).
• For contrast, the dce120 vblank entries DO set .src_id = VISLANDS30_IV_SRCID_D1_VERTICAL_INTERRUPT0 + reg_num = 19..24 (consecutive, verified against ivsrcid_vislands30.h:66-156), so the in-tree-reachable VBLANK path arms pipes 0..5 correctly — the defect is confined to the VUPDATE wiring (whose true src ids are the non-consecutive 7,9,11,13,15,17, ivsrcid_vislands30.h:30-61).

Reproduction (this run, on the audit guest)

Verbatim userland replica (dce120_vupd.c, adapted from DF-5055's harness): dce120 vupdate/vblank macros + the dce120-local vblank funcs table, dce110_vblank_set, to_dal_irq_source_dce110, the set dispatch (irq_service.c:77-124), and the dc→current_state→res_ctx.pipe_ctx[] walk against a 0x5a-poisoned 8MiB mapping with valid timing generators in pipes 0..5. Results (run.log, run.2.log — deterministic x2):

• table: vupdate1 src_id=0 ext_id=0 | vblank1 src_id=19
• double-baked: (uint8_t)(72-78) = 250
• controls: VBLANK1..6 arm pipes 0..5 through the REAL conversion path
• trigger: set(DC_IRQ_SOURCE_VUPDATE1) → pipe_ctx[178] → garbage tg → wild arm_vert_intr → SIGBUS exit 138
• fixed mode (fix.diff): index-derived pipe — all 12 VUPDATE/VBLANK sources arm pipes 0..5, exit 0

Kernel console corroborates (dmesg.txt: pid ... (dce120_vupd_base) ... exited on signal 10 x2 per run).

Reachability (traced honestly — latent)

No in-tree caller ever .sets a VUPDATE source: suspend/resume touch HPD/HPDRX only (amdgpu_dm_irq.c:353/380/406, 625-645); vblank enable is IRQ_TYPE_VBLANK + otg_inst (amdgpu_dm.c:3014-3015); pflip is IRQ_TYPE_PFLIP (amdgpu_dm_irq.c:535-556); the IH converter returns VUPDATE only for src ids 7,9..17 which amdgpu_dm never registers. Service exists only on DCE12 hardware (dce120_resource.c:1011); guest has no AMD GPU.

Ceiling

Far-OOB read feeding a wild indirect call — a groomed heap around the dc_state allocation could in principle aim tg (not demonstrated; honest ceiling is a kernel panic, family-consistent with DF-5055).

Fix validation

fix.diff (two hunks): (1) dce120 vupdate_int_entry gains .src_id = VISLANDS30_IV_SRCID_D1_V_UPDATE_INT + 2 * reg_num (7,9,..,17); (2) dce110_vblank_set derives the pipe from the TABLE INDEX via the vblank_pipe_offset() helper — provably 0..5 for both ranges, the exact DF-4933/DF-5055 fix shape (the dce110 hunk is byte-identical to DF-5055's, the shared-function owner). Applied to guest /usr/src together with DF-5078's diff: hunks succeeded at :192/:226 (dce110) and :140 (dce120); full make -j6 amdgpu.ko rebuild rc=0, 0/0 under -Werror (amdgpu_module_build.log; irq_service_dce110.c compiled at :572); replica fixed mode exit 0 with all 12 sources arming the correct pipes; sources reverted md5-verified pristine (35607b1a.../51bd6ea8...), make clean. Guest returned to clean snapshot afterwards.

Artifacts

dce120_vupd.c (code_hash 44d0edf9...), build.log, run.log, run.2.log, dmesg.txt, env.txt, fix.diff, amdgpu_module_build.log, fix_build.log, fix_run.log, manifest.json, verdict.json.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.