DF-1272 PoC — tonga sclk_table->count Sclk_voltageOffset overflow

Status

INCONCLUSIVE on the audit guest: bug confirmed real by source trace at sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1620, but hardware-gated and not triggerable here. fix.diff authored and validated to apply + compile (nativekernel rc=0, -Werror). See VERDICT.md for the full trace and fix.diff for the patch.

Build

./build.sh

(equivalent: cc -O2 -Wall -o tonga_sclk_voltage_offset_overflow tonga_sclk_voltage_offset_overflow.c)

Run (as unprivileged user)

./run.sh

Expected on the audit guest

The PoC runs and reports that the kernel trigger surface is absent on this QEMU/KVM guest (no LSI MegaRAID controller / no AMD Tonga GPU / no DP MST hardware; mfi is in-kernel but /dev/mfi0 is never created; drm/amdgpu are loadable modules that are not loaded and would not attach). It exits 0 without exercising the sink. The bug is therefore a latent, hardware-dependent defect, not a false positive.

Files

• tonga_sclk_voltage_offset_overflow.c — trigger / documentation PoC
• fix.diff — standalone git apply -p1 patch closing the cited path
• VERDICT.md — full source-level mechanism + reachability + fix analysis
• build.log / run.log — captured build/run output
• fix_build.log — nativekernel compile-validation excerpt (rc=0)
• env.txt — guest environment
• manifest.json — machine-readable artifact catalog

DF-1272 — tonga VBIOS vdd_dep_on_sclk->count drives Sclk_voltageOffset overflow

Verdict

INCONCLUSIVE (hardware-gated latent bug, not triggerable on this guest). The overflow is confirmed real by source tracing; not reachable on the audit QEMU guest because the sink lives in the loadable amdgpu.ko module and runs only on AMD Tonga hardware (with clock-stretching enabled) driven by a (crafted/buggy) VBIOS (absent). fix.diff authored and validated to apply + compile (nativekernel rc=0, -Werror).

Mechanism (source trace)

tonga_populate_clock_stretcher_data_table (sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1620):

uint8_t i;
struct phm_ppt_v1_clock_voltage_dependency_table *sclk_table =
        table_info->vdd_dep_on_sclk;
...
for (i = 0; i < sclk_table->count; i++) {
    ...
    smu_data->smc_state_table.Sclk_voltageOffset[i] = volt_offset;   /* [8] */
}

Array bound: - Sclk_voltageOffset[8] (smu72_discrete.h:344). Immediately followed in the struct by ClockStretcherDataTable and CKS_LOOKUPTable, and downstream by the DpmTable tail / tonga_smumgr.power_tune_defaults pointer.

Count source: - sclk_table->count = VBIOS ucNumEntries (u8, 1–255; only a != 0 check at parse, processpptables.c). With count > 8, i >= 8 writes Sclk_voltageOffset[8..], overflowing into ClockStretcherDataTable, CKS_LOOKUPTable, and — far enough — the power_tune_defaults pointer that is later dereferenced. The written value (volt_offset, a derived u8) is partly attacker/VBIOS-shaped.

Gating: - The function is reached only when PHM_PlatformCaps_ClockStretcher is set in the platform caps (a VBIOS-controlled capability).

Reachability on the audit guest

• tonga_smumgr.c is module-only (amdgpu.ko), not in the base kernel; amdgpu.ko not loaded.
• Runs only on AMD Tonga hardware whose VBIOS enables clock stretching. The guest has no AMD GPU. Not triggerable here.

Exploit chain

None — not exercisable on this guest (module-only + no AMD Tonga HW + VBIOS capability gate). The primitive is an OOB write of a derived byte past Sclk_voltageOffset[8]; reachable only on real Tonga hardware with a malformed VBIOS that enables clock stretching.

PoC changes

Authored tonga_sclk_voltage_offset_overflow.c — documentation stub recording the module-only / VBIOS-driven reachability finding.

Fix validation

• fix.diff applies cleanly: git apply --check -p1 ⇒ OK (1 hunk).
• Compiles: make nativekernel rebuilt amdgpu.ko ⇒ NK_DONE rc=0, tonga_smumgr.c built with -Werror (fix_build.log).
• Functional test: not_testable (no AMD Tonga HW).

Recommended fix

Bound the loop by the array size: for (i = 0; i < sclk_table->count && i < sizeof(...Sclk_voltageOffset)/sizeof(...[0]); i++) (= 8). See fix.diff.