DF-1271 PoC — tonga mm_dep_table->count UvdLevel/VceLevel/AcpLevel overflow

Status

INCONCLUSIVE on the audit guest: bug confirmed real by source trace at sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1307, but hardware-gated and not triggerable here. fix.diff authored and validated to apply + compile (nativekernel rc=0, -Werror). See VERDICT.md for the full trace and fix.diff for the patch.

Build

./build.sh

(equivalent: cc -O2 -Wall -o tonga_mm_dep_overflow tonga_mm_dep_overflow.c)

Run (as unprivileged user)

./run.sh

Expected on the audit guest

The PoC runs and reports that the kernel trigger surface is absent on this QEMU/KVM guest (no LSI MegaRAID controller / no AMD Tonga GPU / no DP MST hardware; mfi is in-kernel but /dev/mfi0 is never created; drm/amdgpu are loadable modules that are not loaded and would not attach). It exits 0 without exercising the sink. The bug is therefore a latent, hardware-dependent defect, not a false positive.

Files

• tonga_mm_dep_overflow.c — trigger / documentation PoC
• fix.diff — standalone git apply -p1 patch closing the cited path
• VERDICT.md — full source-level mechanism + reachability + fix analysis
• build.log / run.log — captured build/run output
• fix_build.log — nativekernel compile-validation excerpt (rc=0)
• env.txt — guest environment
• manifest.json — machine-readable artifact catalog

DF-1271 — tonga VBIOS mm_dep_table->count drives heap overflow

Verdict

INCONCLUSIVE (hardware-gated latent bug, not triggerable on this guest). The overflow is confirmed real by source tracing; not reachable on the audit QEMU guest because the sink lives in the loadable amdgpu.ko module and runs only on AMD Tonga hardware driven by a (crafted/buggy) VBIOS PowerPlay table (absent). fix.diff authored and validated to apply + compile (nativekernel rc=0, -Werror).

Mechanism (source trace)

Three sibling functions in sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c: - tonga_populate_smc_uvd_level (:1307): table->UvdLevelCount = (uint8_t)mm_table->count; then for (count=0; count<UvdLevelCount; count++) table->UvdLevel[count] = ...; (:1323) - tonga_populate_smc_vce_level (:1367): table->VceLevelCount = ...; VceLevel[count]=... (:1383) - tonga_populate_smc_acp_level (:1413): table->AcpLevelCount = ...; AcpLevel[count]=... (:1428)

Array bounds / caps: - SMU72_MAX_LEVELS_UVD = SMU72_MAX_LEVELS_VCE = SMU72_MAX_LEVELS_ACP = 8 (smu72.h:113-115). - SMU72_Discrete_DpmTable: UvdLevel[8], VceLevel[8], AcpLevel[8] (smu72_discrete.h:270-272).

Count source: - mm_table->count = the VBIOS PowerPlay ucNumEntries (a u8, 1–255), assigned in processpptables.c:391 (dep_table->count = (unsigned long)table->ucNumEntries;) with only a != 0 validity check during parse. So count can be up to 255.

With mm_table->count > 8, the loop writes UvdLevel/VceLevel/AcpLevel[8..], overflowing the level arrays into the adjacent SMU72_Discrete_DpmTable fields and, far enough, into the tonga_smumgr power_tune_defaults pointer (subsequently dereferenced) → heap corruption / controlled-pointer deref. The written values (frequencies, voltage indices) are partly VBIOS-derived.

Reachability on the audit guest

• tonga_smumgr.c is module-only: in amdgpu.ko (nm /boot/kernel/amdgpu.ko ⇒ tonga_populate_all_graphic_levels etc.), NOT in the base kernel. amdgpu.ko is not loaded on the guest.
• The functions run during PowerPlay SMC table population on an AMD Tonga GPU, fed by the card's VBIOS. The guest has no AMD GPU (vgapci0 is virtio-class). Not triggerable here.

Exploit chain

None — not exercisable on this guest (module-only + no AMD Tonga HW). The primitive is an OOB write of VBIOS-derived values past UvdLevel/VceLevel/ AcpLevel[8] in an SMU table; reachable only on Tonga hardware with a malformed VBIOS (a malicious discrete-GPU VBIOS is a strong local-attacker primitive on such systems).

PoC changes

Authored tonga_mm_dep_overflow.c — documentation stub recording the module-only / VBIOS-driven reachability finding.

Fix validation

• fix.diff applies cleanly: git apply --check -p1 ⇒ OK (3 hunks).
• Compiles: make nativekernel rebuilt amdgpu.ko ⇒ NK_DONE rc=0, tonga_smumgr.c built with -Werror (fix_build.log).
• Functional test: not_testable (no AMD Tonga HW).

Recommended fix

Clamp each level count to its array cap with min(): table->UvdLevelCount = (uint8_t)min(mm_table->count, (uint32_t)SMU72_MAX_LEVELS_UVD); (and likewise VCE/ACP). See fix.diff.