Stale index used as voltage lookup key in CAC table population (functional correctness)
Summary
tonga_populate_cac_tables SMU7_VOLTAGE_CONTROL_BY_SVID2 branch at tonga_smumgr.c:423-427: phm_get_voltage_index(vddgfx_lookup_table,convert_to_vid(vddgfx_lookup_table->entries[index].us_cac_mid)) uses stale index from previous loop, not per-level VDDGFX voltage (data->vddgfx_voltage_table.entries[count].value). Correct pattern shown in VDDC branch (:411-412) and merged-mode (:430-432). No memory safety issue, functional correctness. Fix: use data->vddgfx_voltage_table.entries[count].value.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1273 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 1.1 KB | view raw |
DF-1273 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Stale index used as voltage lookup key in CAC table population (functional correctness)
Source Location
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:423-427
Verdict
Source-confirmed: Stale index used as voltage lookup key in CAC table population (functi. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
tonga_populate_cac_tables SMU7_VOLTAGE_CONTROL_BY_SVID2 branch at tonga_smumgr.c:423-427: phm_get_voltage_index(vddgfx_lookup_table,convert_to_vid(vddgfx_lookup_table->entries[index].us_cac_mid)) uses stale index from previous loop, not per-level VDDGFX voltage (data->vddgfx_voltage_table.entries[count].value). Correct pattern shown in VDDC branch (:411-412) and merged-mode (:430-432). No memory safety issue, functional correctness. Fix: use data->vddgfx_voltage_table.entries[count].value.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: tonga CAC table population uses stale index variable instead of loop counter count, causing wrong voltage lookup. Fixed entries[index] to entries[count]. HW-gated.
Verified recommended fix
Source-confirmed: tonga CAC table population uses stale index variable instead of loop counter count, causing wrong voltage lookup. Fixed entries[index] to entries[count]. HW-gated.
Verdict
Source-confirmed: tonga CAC table population uses stale index variable instead of loop counter count, causing wrong voltage lookup. Fixed entries[index] to entries[count]. HW-gated.
No comments yet.