CVE-2023-53991

What it actually does

Returns NULL pointers from dpu_rm_get_assigned_resources for unallocated DSC blocks instead of an array of valid pointers, enabling null-pointer dereference when the caller expects num_blks valid resources.

Why it matters to the business

Platform lockups or crashes in display/graphics subsystems on affected systems, causing denial of service and operational downtime; low exploitation likelihood reduces urgency.

How an attack unfolds

An attacker triggers topology requests referencing resources absent from dpu_mdss_cfg; the resource manager returns NULL entries that the caller dereferences, resulting in a hard lockup.

How to fix it

Update rizinorg/rizin to commit 1b6f736c65b9fb8b7ce8a05706edab0f4148985c or later; apply the equivalent kernel patch that adds NULL checks and early return with error logging in dpu_rm_get_assigned_resources.

How to confirm the fix worked

Confirm the patched kernel or rizin binary contains the added bounds check before num_blks increment; test with invalid topologies to verify error path is taken instead of returning NULLs.

Typical attack path

1. Identify or control code paths that request DPU resource topologies
2. Supply a topology referencing DSC blocks not present in platform config
3. Invoke dpu_rm_get_assigned_resources to obtain the malformed array
4. Trigger subsequent dereference of the returned NULL pointers

How to detect it

Review kernel logs for dpu_rm_get_assigned_resources error messages about NULL blocks; inspect crash dumps showing null dereferences in MSM DPU resource handling paths.

What your security team should do

• Apply the referenced commit or kernel patch immediately on all systems using MSM DPU
• Monitor for graphics subsystem crashes or lockups as potential indicators
• Restrict unprivileged access to display topology configuration interfaces where feasible