⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1180

Heap OOB write in voltage-table builders: unbounded dep_table->count overflows entries[32]

Summary

vega10_get_mvdd/vddci/vdd_voltage_table (:1026-1096): vol_table->count=dep_table->count (u8 up to 255); loop writes entries[i] into entries[PP_ATOMFWCTRL_MAX_VOLTAGE_ENTRIES=32]. Post-hoc PP_ASSERT count<=16 fires AFTER OOB write already happened. vega10_trim reads OOB entries[i+diff]. Crafted VBIOS with >32 entries corrupts vega10_hwmgr fields past entries[31]. Fix: clamp count before loop.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1180 · 10 files
FileTypeDescriptionSize
harness.c trigger-source replicates vega10_get_vdd_voltage_table loop with crafted VBIOS count>32 4.0 KB view raw
README.md readme finding summary, why-harness, build/run/expected 1.1 KB ↓ raw
build.sh build-script cc -O2 -Wall -o harness harness.c 107 B view raw
run.sh run-script ./harness 60 B view raw
build.log build-log final build (gcc -Waggressive-loop-optimizations warning at iter 32) 792 B view raw
run.log run-log decisive run: count=40 overflows entries[32], trailing fields struck 1.4 KB view raw
fix.diff suggested-fix clamp vol_table->count=min(dep_table->count,PP_ATOMFWCTRL_MAX_VOLTAGE_ENTRIES) in mvdd/vddci/vdd builders 1.2 KB view raw
env.txt environment uname, cc version 286 B view raw
../fix_build_combined.log build-log Combined 41-finding kernel build (rc=0, -Werror clean) 5.6 MB ↓ download
../fix_build_summary.txt build-summary Summary of the combined 41-finding kernel build 826 B view raw
README.md readme finding summary, why-harness, build/run/expected
↓ download raw

DF-1180 — vega10 voltage-table builders: unbounded dep_table->count overflows entries[32]

Finding

vega10_get_mvdd/vddci/vdd_voltage_table() (vega10_hwmgr.c:1026-1096) set vol_table->count = dep_table->count (a u8 from VBIOS, up to 255) and then loop for (i=0; i<count; i++) vol_table->entries[i] = .... The destination entries[] is sized PP_ATOMFWCTRL_MAX_VOLTAGE_ENTRIES = 32 (ppatomfwctrl.h:36,52). With >32 VBIOS entries the writes overflow the voltage table into whatever follows in the vega10_hwmgr backend. The post-hoc PP_ASSERT_WITH_CODE(... vddc_voltage_table.count <= 16 ...) (:1166) fires after the OOB write has already happened, and vega10_trim_voltage_table_to_fit_state_table() (:1118-1119) then reads entries[i+diff] — also OOB.

Why harness

AMD GPU powerplay is not in X86_64_GENERIC and no AMD GPU is present on the QEMU guest. Harness replays the exact loop against crafted VBIOS count.

Build & run

./build.sh && ./run.sh

Expected

Harness reports writes past entries[31] and the corrupted trailing fields.

Fix verification

not_testable

compile+harness validated

see evidence pack
↓ fix.diffn/a

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

—

Verdict

REPRODUCED (harness). vega10 voltage-table builders count u8 unbounded vs entries[32] -> 223 OOB. amdgpu not in GENERIC.