/* * DF-3585 harness -- heap OOB write in si_get_svi2_voltage_table() * (sys/dev/drm/amd/amdgpu/si_dpm.c:4398-4417) * plus its second sink si_populate_smc_voltage_table() * (sys/dev/drm/amd/amdgpu/si_dpm.c:4499-4507) * * The DragonFly QEMU guest has no AMD GPU (virtio-only), so this harness * replicates the exact kernel data structures and the exact kernel loops * (copied verbatim, only renamed) and proves the out-of-bounds write * arithmetic that a crafted VBIOS drives on a real SI (Tahiti/Verde/...) * card during si_dpm_enable() -> si_construct_voltage_tables(). * * Struct definitions copied verbatim from: * sys/dev/drm/amd/amdgpu/amdgpu_atombios.h:119-133 (atom_voltage_table) * sys/dev/drm/amd/amdgpu/sislands_smc.h:207-224 (SISLANDS_SMC_STATETABLE lowSMIO[32]) * sys/dev/drm/amd/amdgpu/amdgpu_dpm.h (clock_voltage_dependency_table) * Loop bodies copied verbatim from: * sys/dev/drm/amd/amdgpu/si_dpm.c:4407-4414 (si_get_svi2_voltage_table) * sys/dev/drm/amd/amdgpu/si_dpm.c:4503-4506 (si_populate_smc_voltage_table) * * Three demonstrations: * A) canary : entries[] overflow corrupts everything after vddc_voltage_table * inside the (single kalloc'd) si_power_info-style object, * including vddci_voltage_table.count with a BIOS-chosen u16, * and a ps_priv-style pointer slot. * B) guard : victim placed at end of a page followed by PROT_NONE -> * SIGSEGV => the write leaves the object's mapping * (kernel: crosses the end of the si_power_info heap object). * C) lowSMIO : vddci SVI2 table with count=255 (mixed GPIO-VDDC/SVI2-VDDCI * config) drives si_populate_smc_voltage_table() writes past * lowSMIO[32] in the SMC statetable. * D) fix : the same loops with the proposed clamp -> no corruption * (validates fix.diff at logic level). */ #include #include #include #include #include #include #include #include #include /* ---- verbatim: amdgpu_atombios.h:119-133 ---- */ #define MAX_VOLTAGE_ENTRIES 32 struct atom_voltage_table_entry { uint16_t value; uint32_t smio_low; }; struct atom_voltage_table { uint32_t count; uint32_t mask_low; uint32_t phase_delay; struct atom_voltage_table_entry entries[MAX_VOLTAGE_ENTRIES]; }; /* ---- verbatim: amdgpu_dpm.h struct amdgpu_clock_voltage_dependency_table ---- */ struct amdgpu_clock_voltage_dependency_entry { uint32_t clk; uint16_t v; }; struct clk_voltage_dep_table { uint32_t count; struct amdgpu_clock_voltage_dependency_entry *entries; }; /* ---- verbatim layout of the tail of struct evergreen_power_info * (si_dpm.h:668-679) that follows vddc_voltage_table in the single * kzalloc'd struct si_power_info (si_dpm.c:7311) ---- */ struct eg_tail_replica { struct atom_voltage_table vddc_voltage_table; /* the overflow SOURCE */ struct atom_voltage_table vddci_voltage_table; /* first victim */ uint32_t arb_registers[8]; /* bootup_arb_registers */ void *requested_rps_ps_priv; /* amdgpu_ps::ps_priv-style pointer slot */ unsigned char further_heap[2048]; /* rest of si_power_info */ }; #define SI_DPM_C_4407_4414 1 /* marker: loop copied from si_dpm.c:4407-4414 */ /* verbatim rename of si_get_svi2_voltage_table() (si_dpm.c:4398-4417) */ static int si_get_svi2_voltage_table_rep(struct clk_voltage_dep_table *dep, struct atom_voltage_table *voltage_table) { uint32_t i; if (dep == NULL) return -1; voltage_table->mask_low = 0; voltage_table->phase_delay = 0; voltage_table->count = dep->count; /* si_dpm.c:4410 -- BIOS u8, up to 255, NO CLAMP */ for (i = 0; i < voltage_table->count; i++) { /* si_dpm.c:4411 */ voltage_table->entries[i].value = dep->entries[i].v; /* si_dpm.c:4412 OOB WRITE for i>=32 */ voltage_table->entries[i].smio_low = 0; /* si_dpm.c:4413 OOB WRITE for i>=32 */ } return 0; } /* verbatim rename of si_populate_smc_voltage_table() (si_dpm.c:4499-4507) */ struct statetable_rep { uint8_t thermalProtectType, systemFlags, maxVDDCIndexInPPTable, extraFlags; uint32_t lowSMIO[32]; /* sislands_smc.h:215 SISLANDS_MAX_NO_VREG_STEPS = 32 */ uint32_t tail[768]; /* rest of SISLANDS_SMC_STATETABLE (voltageMaskTable, dpm2Params, initialState/ACPI/ULV/driverState, dpmLevels[15]) then papm_parm + fan fields to end of si_power_info */ }; static void si_populate_smc_voltage_table_rep(const struct atom_voltage_table *voltage_table, struct statetable_rep *table) { unsigned int i; for (i = 0; i < voltage_table->count; i++) /* si_dpm.c:4505 -- count up to 255 */ table->lowSMIO[i] |= voltage_table->entries[i].smio_low; /* si_dpm.c:4506 OOB R-M-W for i>=32 */ } /* ---- fix from fix.diff (validated in part D) ---- */ static int si_get_svi2_voltage_table_fixed(struct clk_voltage_dep_table *dep, struct atom_voltage_table *voltage_table) { uint32_t i; if (dep == NULL) return -1; if (dep->count == 0 || dep->count > MAX_VOLTAGE_ENTRIES) /* THE FIX: clamp */ return -1; voltage_table->mask_low = 0; voltage_table->phase_delay = 0; voltage_table->count = dep->count; for (i = 0; i < voltage_table->count; i++) { voltage_table->entries[i].value = dep->entries[i].v; voltage_table->entries[i].smio_low = 0; } return 0; } /* dependency table as built by amdgpu_parse_clk_voltage_dep_table() * (amdgpu_dpm.c:282-305): count = BIOS ucNumEntries (raw u8), entries * kcalloc'd to exactly that count. We simulate the worst legal u8: 255. */ static struct clk_voltage_dep_table *bios_dep_table(uint32_t n) { struct clk_voltage_dep_table *t = calloc(1, sizeof(*t)); uint32_t i; t->count = n; t->entries = calloc(n, sizeof(struct amdgpu_clock_voltage_dependency_entry)); for (i = 0; i < n; i++) { t->entries[i].clk = 10000 + 100 * i; t->entries[i].v = (uint16_t)(0x1000 + i); /* BIOS-chosen u16 voltage */ } return t; } static const uint64_t CANARY = 0xDEADBEEFCAFEF00DULL; static int corrupted_bytes(const unsigned char *zone, size_t n) { int c = 0; size_t i; for (i = 0; i < n; i++) if (zone[i] != ((unsigned char *)&CANARY)[i % 8]) c++; return c; } int main(void) { int rc = 0; setvbuf(stdout, NULL, _IONBF, 0); printf("== DF-3585 harness: si_get_svi2_voltage_table heap OOB write ==\n"); printf("kernel: sys/dev/drm/amd/amdgpu/si_dpm.c:4410-4414, guest: no AMD GPU, logic replica\n\n"); /* ---------------- Part A: intra-object corruption (pristine diff) --------- */ { struct clk_voltage_dep_table *dep = bios_dep_table(255); struct eg_tail_replica *vic = calloc(1, sizeof(struct eg_tail_replica)); struct eg_tail_replica *ref = calloc(1, sizeof(struct eg_tail_replica)); const unsigned char *entries_end; printf("[A] dep->count = %u (BIOS u8 from VddcDependencyOnMCLK.ucNumEntries)\n", dep->count); printf("[A] entries[] capacity = %d (MAX_VOLTAGE_ENTRIES, amdgpu_atombios.h:119)\n", MAX_VOLTAGE_ENTRIES); si_get_svi2_voltage_table_rep(dep, &vic->vddc_voltage_table); printf("[A] vddc_voltage_table.count now = %u (already > capacity)\n", vic->vddc_voltage_table.count); printf("[A] first OOB slot i=32 lands at vddci_voltage_table.count -> now %u (BIOS-chosen u16 0x%04x)\n", vic->vddci_voltage_table.count, vic->vddci_voltage_table.count); printf("[A] vddci_voltage_table.mask_low -> now 0x%x (zeroed by smio_low=0 store)\n", vic->vddci_voltage_table.mask_low); entries_end = (const unsigned char *)&vic->vddc_voltage_table + 12 + 32 * 8; { const unsigned char *v = entries_end, *r = (const unsigned char *)ref + (entries_end - (unsigned char *)vic); const unsigned char *vend = (unsigned char *)vic + sizeof(*vic); size_t diff = 0, i; for (i = 0; v + i < vend; i++) if (v[i] != r[i]) diff++; printf("[A] bytes of the heap object rewritten past entries[32] = %zu (of %zu until object end)\n", diff, (size_t)(vend - entries_end)); if (diff > 0) { printf("[A] RESULT: OOB WRITE CONFIRMED (heap object corrupted)\n"); rc |= 1; } } free(vic); free(ref); free(dep->entries); free(dep); } /* ---------------- Part B: write leaves the allocation (guard page) -------- */ { pid_t pid = fork(); if (pid == 0) { struct clk_voltage_dep_table *dep = bios_dep_table(255); long pg = sysconf(_SC_PAGESIZE); unsigned char *two = mmap(NULL, pg * 2, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); mprotect(two + pg, pg, PROT_NONE); /* guard: first byte past page 1 */ /* place victim so that entries[] ENDs exactly at the page boundary */ size_t vt_size = sizeof(struct atom_voltage_table); struct atom_voltage_table *vic = (struct atom_voltage_table *)(two + pg - vt_size); memset(vic, 0, vt_size); printf("[B] child: victim ends at page boundary %p, guard at %p\n", (void *)(two + pg), (void *)(two + pg)); fflush(stdout); si_get_svi2_voltage_table_rep(dep, vic); /* must fault */ printf("[B] child: NO FAULT -- overflow did NOT leave the page???\n"); fflush(stdout); _exit(0); } else { int st; waitpid(pid, &st, 0); if (WIFSIGNALED(st) && WTERMSIG(st) == SIGSEGV) { printf("[B] child killed by SIGSEGV => the i>=32 stores leave the object mapping\n"); printf("[B] RESULT: OOB WRITE PAST ALLOCATION CONFIRMED (kernel: past si_power_info kalloc end when table sits at object end)\n"); rc |= 2; } else { printf("[B] child exited without SIGSEGV (unexpected)\n"); } } } /* ---------------- Part C: lowSMIO[32] sink (vddci SVI2, mixed config) ----- * si_populate_smc_voltage_table() does lowSMIO[i] |= entries[i].smio_low; * for an SVI2-built table every smio_low is 0, so the operand is 0 -- but * the ACCESS itself is still OOB for i>=32 (read of entries[i] far past * the table, read-modify-write of lowSMIO[i] far past the statetable, * which in the kernel runs off the end of the si_power_info allocation * for i >= ~154). We prove the OOB access with a guard page at * &lowSMIO[32]. */ { pid_t pid = fork(); if (pid == 0) { struct clk_voltage_dep_table *dep = bios_dep_table(255); unsigned char *vblob = calloc(1, sizeof(struct atom_voltage_table) + 4096); struct atom_voltage_table *vddci_svi2 = (struct atom_voltage_table *)vblob; long pg = sysconf(_SC_PAGESIZE); unsigned char *two = mmap(NULL, pg * 2, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); struct statetable_rep *st; mprotect(two + pg, pg, PROT_NONE); /* position statetable so lowSMIO[] ends exactly at the guard page */ st = (struct statetable_rep *)(two + pg - 4 - 32 * 4); memset((void *)st, 0, 4 + 32 * 4); si_get_svi2_voltage_table_rep(dep, vddci_svi2); printf("[C] child: lowSMIO ends at %p, guard page at %p, count=%u\n", (void *)((char *)st + 4 + 128), (void *)(two + pg), vddci_svi2->count); fflush(stdout); si_populate_smc_voltage_table_rep(vddci_svi2, st); /* must fault at i=32 */ printf("[C] child: NO FAULT -- sink did not go OOB???\n"); fflush(stdout); _exit(0); } else { int st; waitpid(pid, &st, 0); if (WIFSIGNALED(st) && WTERMSIG(st) == SIGSEGV) { printf("[C] child killed by SIGSEGV at lowSMIO[32] => si_dpm.c:4505-4506 sink is OOB\n"); printf("[C] RESULT: SECOND SINK CONFIRMED (lowSMIO OOB read-modify-write; kernel object-end overrun for count>~154)\n"); rc |= 4; } else { printf("[C] child exited without SIGSEGV (unexpected)\n"); } } } /* ---------------- Part D: fix validation ---------------------------------- */ { struct clk_voltage_dep_table *dep = bios_dep_table(255); size_t zone_off = sizeof(struct eg_tail_replica); unsigned char *blob = calloc(1, sizeof(struct eg_tail_replica) + 4096); struct eg_tail_replica *vic = (struct eg_tail_replica *)blob; unsigned char *zone = blob + zone_off; size_t i; for (i = 0; i < 4096; i++) zone[i] = ((unsigned char *)&CANARY)[i % 8]; int r = si_get_svi2_voltage_table_fixed(dep, &vic->vddc_voltage_table); int cb = corrupted_bytes(zone, 4096); printf("[D] with fix.diff clamp: ret=%d (rejected oversized BIOS table), canary bytes hit=%d, vddc.count=%u\n", r, cb, vic->vddc_voltage_table.count); if (r != 0 && cb == 0) printf("[D] RESULT: FIX VALIDATED at harness level (no OOB writes)\n"); else { printf("[D] RESULT: FIX FAILED\n"); rc |= 8; } free(blob); free(dep->entries); free(dep); } printf("\nsummary: A=%d B=%d C=%d (1=confirmed) D_fix_ok=%d\n", (rc & 1) ? 1 : 0, (rc & 2) ? 1 : 0, (rc & 4) ? 1 : 0, (rc & 8) ? 0 : 1); return (rc & 7) ? 0 : 1; /* harness "succeeds" when it demonstrated the bug */ }