DF-1320 — Unbounded MST stream_count → stack overflow (amdgpu)

Status: INCONCLUSIVE (real bug; needs AMD GPU + amdgpu + MST hardware, all absent) Impact: stack buffer overflow via malicious MST hub (unauthenticated physical-layer) Driver: amdgpu MST allocation — NOT in X86_64_GENERIC, not loaded

Reproduce (hardware-equipped host only)

Requires an amdgpu host with a malicious MST hub/dock advertising >6 active payloads (LOCAL/REMOTE, non-zero slots). Hotplug → payload negotiation → work_table[6] stack overflow in update_mst_stream_alloc_table.

On the audit guest: amdgpu absent, no AMD GPU, no MST hardware. See VERDICT.md for the source trace and fix.diff for the validated patch.

Files

• VERDICT.md — full mechanism trace with path:line citations
• fix.diff — clamp stream_count to MAX_CONTROLLER_NUM (6) at table update
• build.sh/run.sh — document hardware repro + validate fix.diff applies
• build.log — guest evidence: amdgpu absent
• env.txt, manifest.json

DF-1320 — Unbounded MST stream_count → stack overflow (amdgpu)

Verdict

INCONCLUSIVE (real bug, needs hardware + driver absent from guest). Source trace confirms the stack overflow; it cannot be reproduced on this QEMU audit guest because amdgpu is not in X86_64_GENERIC, is not a loadable module, and there is no AMD GPU / MST hardware. The fix was validated to apply cleanly (git apply --check) against sys/dev/drm/amd/display/dc/core/dc_link.c.

Mechanism

update_mst_stream_alloc_table copies a DRM-proposed payload table into a fixed-size stack workspace:

sys/dev/drm/amd/display/dc/core/dc_link.c:2327  struct link_mst_stream_allocation work_table[MAX_CONTROLLER_NUM] = { 0 };
                                                                          // MAX_CONTROLLER_NUM = 6
sys/dev/drm/amd/display/dc/core/dc_link.c:2335  ASSERT(proposed_table->stream_count - ... < 2);  // compiles to no-op in production
sys/dev/drm/amd/display/dc/core/dc_link.c:2339  for (i = 0; i < proposed_table->stream_count; i++) {   // NO bounds check vs 6
sys/dev/drm/amd/display/dc/core/dc_link.c:2348      work_table[i] = *dc_alloc;       // *** OOB stack write for stream_count>6 ***
sys/dev/drm/amd/display/dc/core/dc_link.c:2355      work_table[i].vcp_id = ...;      // *** and here ***
sys/dev/drm/amd/display/dc/core/dc_link.c:2359      work_table[i].stream_enc = stream_enc;  // *** kernel pointer written ***

MAX_CONTROLLER_NUM = 6 (sys/dev/drm/amd/display/include/link_service_types.h:38). Each link_mst_stream_allocation is ~16 bytes (vcp_id + slot_count + stream_enc pointer), so the 6-entry work_table is ~96 bytes on the stack. proposed_table->stream_count is built upstream by get_payload_table:

sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:150  for (i = 0; i < mst_mgr->max_payloads; i++) {   // max_payloads up to 63
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:157      if (... LOCAL || REMOTE) {
sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:167          proposed_table->stream_count++;          // can reach up to 63

A malicious MST branch device (hub/dock) that advertises >6 payloads in LOCAL/REMOTE state with non-zero num_slots drives stream_count above 6, and the stack work_table overflows. The overflow content includes the kernel stream_enc pointer plus attacker-influenced vcp_id/slot_count. The ASSERT at 2335 is a no-op in production.

This is an unauthenticated physical-layer attack: hotplug a malicious MST hub → payload negotiation → dm_helpers_dp_mst_update_payload_allocator → update_mst_stream_alloc_table.

Reachability on this guest

Identical to DF-1319: amdgpu is absent from the kernel, no module loaded, no AMD GPU, no MST hardware, no /dev/dri. Phase-4(d): real bug, unreachable on this guest.

Exploit chain

Stack buffer overflow (write-capable) on a display-driver code path driven by physical MST-layer attacker input — not a userspace-reachable path on the audit guest. Realistic impact ceiling on an amdgpu host: stack corruption in update_mst_stream_alloc_table → potential kernel RCE via a malicious MST peripheral. No userspace escalation chain applies.

PoC changes

No runnable userspace PoC (MST-peripheral attack). Folder was empty. Authored build.sh/run.sh documenting the hardware-required reproduction and validating fix.diff applies cleanly.

Fix

fix.diff clamps proposed_table->stream_count to MAX_CONTROLLER_NUM at the top of update_mst_stream_alloc_table (after the existing ASSERT), invoking BREAK_TO_DEBUGGER() (already used in the file at :351) on the over-count before truncating. Surplus payloads a malicious hub claims are dropped, and the fixed-size work_table can no longer be overrun. Applies cleanly (git apply --check).

Fix validation

fix_status: not_testable — amdgpu not in the kernel build on this guest, so neither bug nor fix is runtime/compile-exercisable here. Validated by clean git apply --check and source inspection (the clamp uses the existing MAX_CONTROLLER_NUM constant and BREAK_TO_DEBUGGER macro).