DF-1251 — reproduction

Userspace harness replicating the unbounded combios_parse_mmio_table while (RBIOS16(offset)) walk and the resulting OOB reads + heap-sourced WREG32 writes.

The live kernel trigger requires an AMD/ATI radeon GPU with a malicious Video BIOS (absent from the QEMU guest); the harness proves the unbounded- loop OOB + MMIO-write primitive.

./build.sh && ./run.sh

Expected: PRIMITIVE CONFIRMED: unbounded loop read 2 words past rdev->bios into heap, and wrote 75 (addr,val) pairs to GPU MMIO (WREG32). Bug is REAL.

Fix: fix.diff adds a bios_length field + bounds the three table-walk loops. Builds cleanly into radeon.ko (-Werror). See VERDICT.md.

DF-1251 — radeon COMBIOS table-walk loops over-read BIOS + write GPU MMIO

Verdict (one line)

CONFIRMED REAL (source trace + harness primitive), NOT reproduced on audit guest (no AMD/ATI radeon GPU).

Finding

sys/dev/drm/radeon/radeon_combios.c parses legacy COMBIOS tables with while (RBIOS16(offset)) / while (RBIOS8(offset)) loops that advance offset purely from BIOS content and have no upper bound against the BIOS allocation. A malicious Video BIOS whose table never contains a zero terminator inside the allocation drives RBIOS8/16/32 past rdev->bios into adjacent kernel heap, and those heap-sourced addr/val pairs are written to GPU MMIO via WREG32 — arbitrary GPU register writes.

Mechanism (path:line)

1. sys/dev/drm/radeon/radeon.h:2686-2688: #define RBIOS8(i) (rdev->bios[i]) #define RBIOS16(i) (RBIOS8(i) | (RBIOS8((i)+1) << 8)) #define RBIOS32(i) ((RBIOS16(i)) | (RBIOS16((i)+2) << 16)) — direct array index, no bounds.
2. radeon_combios.c:3010 combios_parse_mmio_table: while (RBIOS16(offset)) { ... addr = RBIOS16(offset) & 0x1fff; ... val = RBIOS32(offset); ... WREG32(addr, val); }
3. radeon_combios.c:3089 combios_parse_pll_table: while (RBIOS8(offset)) { ... WREG32_PLL(addr, val); }
4. radeon_combios.c:3182 combios_parse_ram_reset_table: while (val != 0xff) { ... RBIOS16(offset); ... }
5. None of these bounds offset against the BIOS allocation size, so the loop walks past rdev->bios (which can be as small as 512 bytes) into heap, and the heap-sourced values are written to GPU MMIO (WREG32).

Why not reproduced on the audit guest

radeon is a loadable DRM module, not in GENERIC, and the guest has no AMD/ATI GPU. COMBIOS tables are parsed during GPU attach from the card's Video BIOS, which is absent. Realistic trigger: a malicious GPU Video BIOS (e.g. hotplug PCIe card with a crafted ROM). Legitimate "malicious peripheral firmware" threat, not exercisable on this guest.

Primitive proof (harness)

harness.c models a 512-byte BIOS slab whose mmio table has no in-bounds zero terminator and runs a verbatim combios_parse_mmio_table walk:

BIOS allocation = 512 bytes; table starts at 0x40 (no in-bounds terminator)
RBIOS8/16/32 reads past BIOS allocation (OOB): 2
WREG32 GPU-MMIO writes with heap-sourced addr/val: 75
PRIMITIVE CONFIRMED: unbounded loop read 2 words past rdev->bios into heap,
and wrote 75 (addr,val) pairs to GPU MMIO (WREG32). Bug is REAL.

Fix

fix.diff (3 files): - radeon.h: add uint32_t bios_length;. - radeon_bios.c: set rdev->bios_length = size; at every alloc site. - radeon_combios.c: bound the three table-walk loops so they stop when offset + <max access> would exceed rdev->bios_length. Validated: builds cleanly into radeon.ko with -Werror (incremental rebuild of the changed radeon_combios.c succeeded). (DF-1250's fix shares the same bios_length infrastructure.)

Reproduce

ssh dfbsd-maxx; cd poc/DF-1251 && cc -O2 -Wall -o harness harness.c && ./harness