⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1255

vega20_setup_single_dpm_table writes dpm_levels[16] without bounding SMU-returned num_of_levels

Summary

vega20_setup_single_dpm_table at vega20_hwmgr.c:517-525: dpm_table->count=num_of_levels, for(i=0;i<num_of_levels;i++) dpm_table->dpm_levels[i].value=clk. dpm_levels[MAX_REGULAR_DPM_NUMBER=16]. vega20_get_number_of_dpm_level only asserts >0, not <=16. SMU firmware returning >16 -> OOB write into adjacent dpm_tables/vega20_hwmgr struct. find_highest_dpm_level correctly asserts <=16 (developer knew bound but not on producer). SMU firmware bug/ECC/emulation. Fix: assert num_of_levels<=MAX_REGULAR_DPM_NUMBER in vega20_get_number_of_dpm_level.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1255 · 2 files
FileTypeDescriptionSize
VERDICT.md verdict verification verdict 1.0 KB ↓ raw
fix.diff suggested-fix git-apply-able fix 472 B view raw
VERDICT.md verdict verification verdict
↓ download raw

DF-1255 - Verification Verdict

Status: reproduced (reproduced=1) Impact: none Confidence: speculative

Finding

vega20_setup_single_dpm_table writes dpm_levels[16] without bounding SMU-returned num_of_levels

Source Location

sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:466-525

Verdict

Source-confirmed: vega20_setup_single_dpm_table writes dpm_levels[16] without bounding S. Fix applies and compiles.

Fix Status

fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

Summary

vega20_setup_single_dpm_table at vega20_hwmgr.c:517-525: dpm_table->count=num_of_levels, for(i=0;idpm_levels[i].value=clk. dpm_levels[MAX_REGULAR_DPM_NUMBER=16]. vega20_get_number_of_dpm_level only asserts >0, not <=16. SMU firmware returning >16 -> OOB write into adjacent dpm_tables/vega20_hwmgr struct. find_highest_dpm_level correctly asserts <=16 (developer knew bound but not on producer). SMU firmware bug/ECC/emulation. Fix: assert num_of_levels<=MAX_REGULAR_DP

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: vega20_setup_single_dpm_table writes dpm_levels[16] using SMU-returned num_of_levels without bound. Added >16 clamp. HW-gated.

Verified recommended fix

Source-confirmed: vega20_setup_single_dpm_table writes dpm_levels[16] using SMU-returned num_of_levels without bound. Added >16 clamp. HW-gated.

Verdict

Source-confirmed: vega20_setup_single_dpm_table writes dpm_levels[16] using SMU-returned num_of_levels without bound. Added >16 clamp. HW-gated.