DF-4864 / run.log
DF-4864 harness: amdgpu_vm_clear_bo() 64-byte IB vs 2x10-dw set_pte_pde + SDMA pad
kernel refs: amdgpu_vm.c:855 alloc(64) / :867-874 dual emit / sdma_v4_0.c:1184-1200 emit
sdma_v4_0.c:1208-1222 pad / amdgpu_ib.c:61-81 SA(64,align 256)
== hardware probe (kernel-path reachability on THIS host) ==
/dev/dri/0: No such file or directory (no DRM node usable)
/dev/drm/0: No such file or directory
AMD (0x1002) VGA device: absent
-> amdgpu(4) can attach on this host: NO
[Raven-root-512] amdgpu_job_alloc_with_ib(adev, 64, &job): ib buffer = 16 dwords (64 bytes)
[Raven-root-512] after set_pte_pde(ats_entries=256): length_dw=10
[Raven-root-512] after set_pte_pde(entries=256): length_dw=20
[Raven-root-512] after amdgpu_ring_pad_ib(): length_dw=24
[Raven-root-512] WARN_ON(length_dw > 64) in kernel: silent (bound is the BYTE size โ never trips)
[Raven-root-512] *** OOB WRITE: 8 dwords (32 bytes) past the 64-byte SA sub-allocation ***
[Raven-root-512] *** 32/256 canary bytes after the IB destroyed; first OOB dwords: 0x00000000 0x00000000 0x00000000 0x000000ff 0x00000000 0x00000000 0x00000000 0x00000000 ***
[Raven2-root-257] amdgpu_job_alloc_with_ib(adev, 64, &job): ib buffer = 16 dwords (64 bytes)
[Raven2-root-257] after set_pte_pde(ats_entries=256): length_dw=10
[Raven2-root-257] after set_pte_pde(entries=1): length_dw=20
[Raven2-root-257] after amdgpu_ring_pad_ib(): length_dw=24
[Raven2-root-257] WARN_ON(length_dw > 64) in kernel: silent (bound is the BYTE size โ never trips)
[Raven2-root-257] *** OOB WRITE: 8 dwords (32 bytes) past the 64-byte SA sub-allocation ***
[Raven2-root-257] *** 32/256 canary bytes after the IB destroyed; first OOB dwords: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 ***
[non-ATS-single] amdgpu_job_alloc_with_ib(adev, 64, &job): ib buffer = 16 dwords (64 bytes)
[non-ATS-single] after set_pte_pde(entries=512): length_dw=10
[non-ATS-single] after amdgpu_ring_pad_ib(): length_dw=16
[non-ATS-single] WARN_ON(length_dw > 64) in kernel: silent (bound is the BYTE size โ never trips)
[non-ATS-single] fits exactly (no overrun) โ this is the non-ATS / non-root case
== summary ==
cases with OOB write: YES โ 32-byte (24dw) overrun into 16dw buffer
EXIT=0