AMD GPU Driver I2C Race Condition Leading to Kernel NULL Pointer Dereference Analysis

Vulnerability Summary: I2C Visibility Race Condition in DM1004 Driver Vulnerability Overview Type: Race Condition Description: In the DM1004 driver, I2C adapters may remain visible during the teardown process. This can cause to be invoked after the I2C state has been torn down, leading to a NULL pointer dereference. Trigger Scenario: During device removal, the I2C adapter accesses a freed or uninitialized structure within . Scope of Impact Affected Component: The function, located in Impact: Kernel panic caused by a NULL pointer dereference. Call Stack: Proposed Fix Core Approach: Introduce a structure to manage the lifecycle of I2C adapters. It is created during device initialization and released during device removal, ensuring that I2C adapters are not visible during teardown. Key Changes: 1. Add a field to to manage the lifecycle of I2C adapters. 2. Create and initialize the I2C bus in . 3. Release in to ensure I2C adapters are properly cleaned up upon device removal. 4. In , return an error if is not initialized, preventing access to an uninitialized I2C bus. PoC / Fix Code Snippets 1. New Structure (Located in ) 2. Modified (Located in ) 3. Modified (Located in ) 4. Modified (Located in ) 5. New Structure Definition (Located in ) ```c / devres_group: Devres group for DM I2C adapter lifetime management. / void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_devres_group; void i2c_dev

Goal Reached Thanks to every supporter — we hit 100%!

AMD GPU Driver I2C Race Condition Leading to Kernel NULL Pointer Dereference Analysis

More from this source