Unchecked firmware-size read of FIJI SMC firmware (heap OOB read) with missing release_firmware
Summary
amdgpu_device_need_post() FIJI passthrough branch at amdgpu_device.c:757-762: request_firmware for amdgpufw_fiji_smc, then fw_ver=*((uint32_t*)adev->pm.fw->data+69) at byte offset 276 with NO size check. firmware_get sets datasize=file length; file<280 bytes -> heap OOB read past firmware slab. No amdgpu_ucode_validate called (unlike parse_gpu_info_fw). Missing release_firmware on this path. Only CHIP_FIJI passthrough. Fix: check datasize>=280, release on too-short.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1256 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1015 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 530 B | view raw |
DF-1256 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Unchecked firmware-size read of FIJI SMC firmware (heap OOB read) with missing release_firmware
Source Location
sys/dev/drm/amd/amdgpu/amdgpu_device.c:757-765
Verdict
Source-confirmed: Unchecked firmware-size read of FIJI SMC firmware (heap OOB read) with. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
amdgpu_device_need_post() FIJI passthrough branch at amdgpu_device.c:757-762: request_firmware for amdgpufw_fiji_smc, then fw_ver=((uint32_t)adev->pm.fw->data+69) at byte offset 276 with NO size check. firmware_get sets datasize=file length; file<280 bytes -> heap OOB read past firmware slab. No amdgpu_ucode_validate called (unlike parse_gpu_info_fw). Missing release_firmware on this path. Only CHIP_FIJI passthrough. Fix: check datasize>=280, release on too-short.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: amdgpu_device FIJI SMC fw reads data[69] without checking datasize>=280, and never calls release_firmware. Added size check + release. HW-gated.
Verified recommended fix
Source-confirmed: amdgpu_device FIJI SMC fw reads data[69] without checking datasize>=280, and never calls release_firmware. Added size check + release. HW-gated.
Verdict
Source-confirmed: amdgpu_device FIJI SMC fw reads data[69] without checking datasize>=280, and never calls release_firmware. Added size check + release. HW-gated.
No comments yet.