β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5233

Underlay OPP constructed with NULL regs/shift/mask while every entry in its vtable dereferences regs (latent NULL-deref held off only by four cross-file invariants)

Summary

dce110_opp_v_construct sets only base.funcs/ctx on a kzalloc'd struct - opp110->regs/shift/mask stay NULL while all four vtable entries expand REG() through opp110->regs->reg. Safety today is an emergent property of four independent cross-subsystem invariants (video-format gate, DM primary-planes-rgb-only - whose own TODO would break it, layer-pipe opp overwrite, top-pipe-only apply). Carrizo/Stoney + >=3 streams precondition. Consolidate with real opp_regs[] (upstream deleted the _v variant). Defense-in-depth.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5233 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.0 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5233

Confirmed kernel references

Detail

Evidence (decisive lines)

static four-invariant trace in finding markdown

Verified recommended fix

construct underlay OPP with real opp_regs[] tables (upstream consolidation)

Verdict

untested (Info hardening; needs Carrizo/Stoney HW + a kernel change relaxing a documented invariant)