⬢ DragonFlyBSD Kernel Audit
DF-5181 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-5181",
  "file": "sys/dev/drm/amd/powerplay/smumgr/smu9_smumgr.c",
  "title": "smu9_send_msg_to_smc/_with_parameter return 0 on SMC failure - vacuous caller guards and stale smu9_get_argument() data",
  "verdict": "untested",
  "reproduced": false,
  "impact": "none",
  "severity": "Low",
  "confidence": "certain",
  "verdict_summary": "Low severity, hardware-fault-gated (Vega10/12 + wedged SMC fw); no unprivileged trigger, no memory-unsafe sink (driver-fixed table sizes); vendored parity with upstream Linux; Phase V skipped, fix not runtime-validated on guest (no AMD silicon).",
  "reproduce": {
    "build": "n/a (no PoC - defect demonstrated by source citation)",
    "run": "n/a",
    "expected": "On Vega10/12 silicon with hung SMC: pr_err 'No response from smu'/'Failed to send message' yet callers proceed with return value 0; smu9_get_argument() returns stale C2PMSG_82."
  },
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/smu9_smumgr.c:116",
    "sys/dev/drm/amd/powerplay/smumgr/smu9_smumgr.c:146",
    "sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:147",
    "sys/dev/drm/amd/powerplay/smumgr/vega12_smumgr.c:52",
    "sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:161"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}