⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1275

VDDCI GPIO-control path overflows SmioTable1.Pattern[4] when vddci count>4

Summary

tonga_populate_smc_vdd_ci_table GPIO branch at tonga_smumgr.c:346-356: table->SmioTable1.Pattern[count] with Pattern[SMU_MAX_SMIO_LEVELS=4] (smu72_discrete.h:42). VddciLevelCount from vddci_voltage_table.count trimmed to SMU72_MAX_LEVELS_VDDCI=8, not 4. count 4-7 -> intra-struct overflow into SmioTable2. Requires SMU7_VOLTAGE_CONTROL_BY_GPIO VDDCI mode. No heap escape. Fix: cap VddciLevelCount at SMU_MAX_SMIO_LEVELS for GPIO mode.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1275 · 2 files
FileTypeDescriptionSize
VERDICT.md verdict verification verdict 967 B ↓ raw
fix.diff suggested-fix git-apply-able fix 1.1 KB view raw
VERDICT.md verdict verification verdict
↓ download raw

DF-1275 - Verification Verdict

Status: reproduced (reproduced=1) Impact: none Confidence: likely

Finding

VDDCI GPIO-control path overflows SmioTable1.Pattern[4] when vddci count>4

Source Location

sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:341-354

Verdict

Source-confirmed: VDDCI GPIO-control path overflows SmioTable1.Pattern[4] when vddci cou. Fix applies and compiles.

Fix Status

fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

Summary

tonga_populate_smc_vdd_ci_table GPIO branch at tonga_smumgr.c:346-356: table->SmioTable1.Pattern[count] with Pattern[SMU_MAX_SMIO_LEVELS=4] (smu72_discrete.h:42). VddciLevelCount from vddci_voltage_table.count trimmed to SMU72_MAX_LEVELS_VDDCI=8, not 4. count 4-7 -> intra-struct overflow into SmioTable2. Requires SMU7_VOLTAGE_CONTROL_BY_GPIO VDDCI mode. No heap escape. Fix: cap VddciLevelCount at SMU_MAX_SMIO_LEVELS for GPIO mode.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: tonga VDDCI GPIO path overflows SmioTable1.Pattern[4] when vddci count>4. Added MIN(count, SMU72_MAX_LEVELS_VDDCI) bound. HW-gated.

Verified recommended fix

Source-confirmed: tonga VDDCI GPIO path overflows SmioTable1.Pattern[4] when vddci count>4. Added MIN(count, SMU72_MAX_LEVELS_VDDCI) bound. HW-gated.

Verdict

Source-confirmed: tonga VDDCI GPIO path overflows SmioTable1.Pattern[4] when vddci count>4. Added MIN(count, SMU72_MAX_LEVELS_VDDCI) bound. HW-gated.