Bogus-length firmware kept loaded: missing goto out after me/rlc/mc/smc size checks causes OOB heap reads
Summary
ni_init_microcode at ni.c:769-817: ME/RLC/MC/SMC size checks set err=-EINVAL but do NOT goto out (unlike PFP at :757 which does). Next request_firmware overwrites err. Function returns 0 with wrong-sized firmware attached. Consumers (cayman_cp_load_microcode :1543-1552 CAYMAN_PM4_UCODE_SIZE=8704 dwords, ni_mc_load_microcode :668 BTC_MC_UCODE_SIZE=6024 dwords, evergreen.c:4406 RLC size) iterate compile-time constant count over undersized buffer -> OOB heap read up to ~8KB into MMIO. Requires corrupt firmware in root-owned path. Fix: add goto out after each size check.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1316 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 341 B | view raw |
DF-1316 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
Bogus-length firmware kept loaded: missing goto out after me/rlc/mc/smc size checks causes OOB heap reads
Source Location
sys/dev/drm/radeon/ni.c:769-817
Verdict
Source-confirmed: Bogus-length firmware kept loaded: missing goto out after me/rlc/mc/sm. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
ni_init_microcode at ni.c:769-817: ME/RLC/MC/SMC size checks set err=-EINVAL but do NOT goto out (unlike PFP at :757 which does). Next request_firmware overwrites err. Function returns 0 with wrong-sized firmware attached. Consumers (cayman_cp_load_microcode :1543-1552 CAYMAN_PM4_UCODE_SIZE=8704 dwords, ni_mc_load_microcode :668 BTC_MC_UCODE_SIZE=6024 dwords, evergreen.c:4406 RLC size) iterate compile-time constant count over undersized buffer -> OOB heap read up to ~8KB into MMIO. Requires corr
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: ni.c me_fw bogus-length check sets err=-EINVAL but falls through without goto out, keeps bogus fw loaded. Added goto out. HW-gated.
Verified recommended fix
Source-confirmed: ni.c me_fw bogus-length check sets err=-EINVAL but falls through without goto out, keeps bogus fw loaded. Added goto out. HW-gated.
Verdict
Source-confirmed: ni.c me_fw bogus-length check sets err=-EINVAL but falls through without goto out, keeps bogus fw loaded. Added goto out. HW-gated.
No comments yet.