โฌข DragonFlyBSD Kernel Audit
DF-4864 / run.2.log
โ† back to finding โ†“ download raw
DF-4864 harness: amdgpu_vm_clear_bo() 64-byte IB vs 2x10-dw set_pte_pde + SDMA pad
kernel refs: amdgpu_vm.c:855 alloc(64) / :867-874 dual emit / sdma_v4_0.c:1184-1200 emit
             sdma_v4_0.c:1208-1222 pad / amdgpu_ib.c:61-81 SA(64,align 256)

== hardware probe (kernel-path reachability on THIS host) ==
   /dev/dri/0: No such file or directory (no DRM node usable)
   /dev/drm/0: No such file or directory
   AMD (0x1002) VGA device: absent
   -> amdgpu(4) can attach on this host: NO

[Raven-root-512] amdgpu_job_alloc_with_ib(adev, 64, &job): ib buffer = 16 dwords (64 bytes)
[Raven-root-512] after set_pte_pde(ats_entries=256): length_dw=10
[Raven-root-512] after set_pte_pde(entries=256):     length_dw=20
[Raven-root-512] after amdgpu_ring_pad_ib():           length_dw=24
[Raven-root-512] WARN_ON(length_dw > 64) in kernel: silent (bound is the BYTE size โ€” never trips)
[Raven-root-512] *** OOB WRITE: 8 dwords (32 bytes) past the 64-byte SA sub-allocation ***
[Raven-root-512] *** 32/256 canary bytes after the IB destroyed; first OOB dwords: 0x00000000 0x00000000 0x00000000 0x000000ff 0x00000000 0x00000000 0x00000000 0x00000000 ***

[Raven2-root-257] amdgpu_job_alloc_with_ib(adev, 64, &job): ib buffer = 16 dwords (64 bytes)
[Raven2-root-257] after set_pte_pde(ats_entries=256): length_dw=10
[Raven2-root-257] after set_pte_pde(entries=1):     length_dw=20
[Raven2-root-257] after amdgpu_ring_pad_ib():           length_dw=24
[Raven2-root-257] WARN_ON(length_dw > 64) in kernel: silent (bound is the BYTE size โ€” never trips)
[Raven2-root-257] *** OOB WRITE: 8 dwords (32 bytes) past the 64-byte SA sub-allocation ***
[Raven2-root-257] *** 32/256 canary bytes after the IB destroyed; first OOB dwords: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 ***

[non-ATS-single] amdgpu_job_alloc_with_ib(adev, 64, &job): ib buffer = 16 dwords (64 bytes)
[non-ATS-single] after set_pte_pde(entries=512):     length_dw=10
[non-ATS-single] after amdgpu_ring_pad_ib():           length_dw=16
[non-ATS-single] WARN_ON(length_dw > 64) in kernel: silent (bound is the BYTE size โ€” never trips)
[non-ATS-single] fits exactly (no overrun) โ€” this is the non-ATS / non-root case

== summary ==
   cases with OOB write: YES โ€” 32-byte (24dw) overrun into 16dw buffer
EXIT=0