DF-5233
Underlay OPP constructed with NULL regs/shift/mask while every entry in its vtable dereferences regs (latent NULL-deref held off only by four cross-file invariants)
Summary
dce110_opp_v_construct sets only base.funcs/ctx on a kzalloc'd struct - opp110->regs/shift/mask stay NULL while all four vtable entries expand REG() through opp110->regs->reg. Safety today is an emergent property of four independent cross-subsystem invariants (video-format gate, DM primary-planes-rgb-only - whose own TODO would break it, layer-pipe opp overwrite, top-pipe-only apply). Carrizo/Stoney + >=3 streams precondition. Consolidate with real opp_regs[] (upstream deleted the _v variant). Defense-in-depth.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5233 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5233
Confirmed kernel references
Detail
Evidence (decisive lines)
static four-invariant trace in finding markdown
Verified recommended fix
construct underlay OPP with real opp_regs[] tables (upstream consolidation)
Verdict
untested (Info hardening; needs Carrizo/Stoney HW + a kernel change relaxing a documented invariant)
No comments yet.