# PoC DF-1484: amdgpu_cs IB chunk missing size check (OOB read of kdata)

**Class:** heap OOB read
**Cited site:** `sys/dev/drm/amd/amdgpu/amdgpu_cs.c:181-184, 999`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — amdgpu HW-gated as above. Trigger is a CS chunk with chunk_id=AMDGPU_CHUNK_ID_IB and length_dw too small for struct drm_amdgpu_cs_chunk_ib (32 bytes).

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/drm/amd/amdgpu/amdgpu_cs.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

amdgpu_cs_parser_bodies (181-184) AMDGPU_CHUNK_ID_IB case only does `++num_ibs` with no minimum-size check, unlike FENCE (188) and BO_HANDLES (202). kdata is allocated as kvmalloc_array(length_dw, 4) at 169 — for length_dw < 8 (=32/4), the allocation is smaller than `struct drm_amdgpu_cs_chunk_ib`. amdgpu_cs_ib_fill:999 then casts kdata to `struct drm_amdgpu_cs_chunk_ib *` and reads its fields (ip_type, flags, etc.) → OOB read of the (small) kdata allocation.

## Realistic impact ceiling

leak (info leak / DoS)

## Fix

In the IB chunk case, check `length_dw * sizeof(uint32_t) < sizeof(struct drm_amdgpu_cs_chunk_ib)` and return -EINVAL like the FENCE/BO_HANDLES cases do.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1484.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1484.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/drm/amd/amdgpu && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```