⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1179

Heap OOB write in DPM-table population: unbounded VBIOS ucNumEntries overflows dpm_levels[8]

Summary

vega10_setup_default_single_dpm_table (:1200-1217 soc/gfx/mclk) and inline eclk/vclk/dclk loops (:1343-1383) iterate dep_table->count (u8 from VBIOS ucNumEntries, up to 255) writing dpm_levels[dpm_table->count++] into dpm_levels[MAX_REGULAR_DPM_NUMBER=8]. No bound check. >8 ascending entries -> heap overflow of vega10_hwmgr backend. Same class as DF-1166 (smu7_hwmgr). Fix: cap at MAX_REGULAR_DPM_NUMBER.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1179 · 10 files
FileTypeDescriptionSize
harness.c trigger-source replicates vega10_setup_default_single_dpm_table loop with crafted VBIOS count>8 4.5 KB view raw
README.md readme finding summary, why-harness, build/run/expected 1.2 KB ↓ raw
build.sh build-script cc -O2 -Wall -o harness harness.c 107 B view raw
run.sh run-script ./harness 60 B view raw
build.log build-log final build 13 B view raw
run.log run-log decisive run: count escapes dpm_levels[8], corrupts adjacent gfx_table 719 B view raw
fix.diff suggested-fix clamp dep_table->count and dep_mm_table->count to MAX_REGULAR_DPM_NUMBER 1.8 KB view raw
env.txt environment uname, cc version 286 B view raw
../fix_build_combined.log build-log Combined 41-finding kernel build (rc=0, -Werror clean) 5.6 MB ↓ download
../fix_build_summary.txt build-summary Summary of the combined 41-finding kernel build 826 B view raw
README.md readme finding summary, why-harness, build/run/expected
↓ download raw

DF-1179 — vega10 DPM-table population: unbounded VBIOS ucNumEntries overflows dpm_levels[8]

Finding

vega10_setup_default_single_dpm_table() (vega10_hwmgr.c:1200-1217) and the inline eclk/vclk/dclk loops (:1343-1383) iterate dep_table->count — a u8 sourced from VBIOS (ucNumEntries, 0-255) — and write dpm_levels[dpm_table->count++]. The destination is sized MAX_REGULAR_DPM_NUMBER = 8 (vega10_hwmgr.h:122,136). With >8 ascending entries dpm_table->count exceeds 8 and the writes overflow into the following vega10_single_dpm_table members of the vega10_hwmgr backend (gfx_table, mem_table, …, then non-table fields). There is no bound check (compare vega12_hwmgr.c:989 which does clamp).

Why harness

AMD GPU powerplay is not in X86_64_GENERIC (no device drm/radeon/ amdgpu in the kernel config; no AMD GPU on the QEMU guest). The VBIOS dependency tables are read from the GPU's PCIe ROM. The bug is demonstrated at the function level with a harness that replays the exact loop against crafted VBIOS count.

Build & run

./build.sh && ./run.sh

Expected

Harness reports count climbing past 8 and identifies the overflowed adjacent vega10_single_dpm_table field in the backend.

Fix verification

not_testable

compile+harness validated

see evidence pack
↓ fix.diffn/a

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

—

Verdict

REPRODUCED (harness). vega10_setup_default_single_dpm_table dep_table->count u8 unbounded vs MAX_REGULAR_DPM_NUMBER=8. amdgpu not in GENERIC.