DF-1353 — vega12_force_clock_level OOB read dpm_levels[16..31]

Summary

Check soft_min_level/soft_max_level < count before indexing dpm_levels[].

How to reproduce

This bug lives in a device driver not reachable from the booted QEMU guest as an unprivileged user (maxx) because the required hardware is absent (AMD GPU, RAID HBA, sound PCI, AMD SCSI) or the trigger requires a malicious hypervisor (virtio_net, virtio_scsi). The bug is reproduced at the function level by porting the cited code path into a userspace harness that drives it with the attacker-controlled inputs the original code fails to validate.

Build

cc -O2 -Wall -o trigger trigger.c

Run

./trigger

Expected

• BEFORE-FIX section shows the bug signature (SIGFPE for div-by-zero, OOB index report for overflows, wraparound count for underflows, over-read length for info leaks).
• AFTER-FIX section shows the guard from fix.diff cleanly rejecting the attacker input.

The same harness was compiled and run on the patched single-fix kernel (DragonFly 6.5-DEVELOPMENT #1) — output is identical because the harness intentionally demonstrates both the unpatched and patched function logic side by side, and the userspace behavior of those branches is independent of the kernel. The patched kernel build (fix_build.log) confirms all 15 fix.diffs compile cleanly in the real kernel / module context.

Impact classification

leak — gated by absent hardware / malicious-hypervisor precondition on this guest; live trigger from maxx is not possible. See VERDICT.md for the threat-model analysis.

Files

• trigger.c — function-level harness porting the cited code path.
• fix.diff — git-apply-able unified diff against sys/.
• build.sh / run.sh — exact repro commands.
• run.log — decisive harness output (BEFORE-FIX + AFTER-FIX).
• fix_build.log — patched kernel build log (proves all 15 fixes compile).
• VERDICT.md — full narrative analysis.
• manifest.json — machine-readable catalog.

Host has no gcc; harnesses built in guest as maxx with cc (DragonFly gcc 8.3).

DF-1353 — VERDICT

REPRODUCED at the function level (impact: leak).

Mechanism

vega12_force_clock_level() at vega12_hwmgr.c:1807-1813 computes soft_min_level = ffs(mask)-1 and soft_max_level = fls(mask)-1 (range 0..31) from a user-supplied mask written via the pp_dpm_sclk/mclk sysfs attribute. data->dpm_table.gfx_table.dpm_levels[] is sized MAX_REGULAR_DPM_NUMBER = 16. Any mask with bit 16 or higher set (e.g. 0x10000, 0x80000000) yields soft_min/max_level >= 16, reading dpm_levels[16..31] OOB into sibling tables/softc. vega20 has a guard; vega12 missing.

Why not live-reproduced on the QEMU guest

AMD Vega10/12 GPU absent from QEMU guest. The amdgpu powerplay module loads only on matching HW. Triggered via sysfs by an authenticated local user.

Recommended fix

In both PP_SCLK and PP_MCLK cases of vega12_force_clock_level, after computing soft_min_level/soft_max_level, check 'if (soft_min_level >= data->dpm_table.{gfx,mem}_table.count || soft_max_level >= ...count) return -EINVAL;'.

Kernel references (confirmed during verification)

• sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1807-1808 (ffs/fls of mask)
• sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1810-1813 (unguarded dpm_levels[soft_min/max_level] index)
• sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.h:96 (MAX_REGULAR_DPM_NUMBER=16)
• sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.h:110 (dpm_levels[16])

Build/run

• Build harness: cc -O2 -Wall -o trigger trigger.c
• Run harness: ./trigger
• Apply fix: cd /usr/src && patch -p1 < fix.diff
• Build single-fix kernel: make -j6 nativekernel KERNCONF=X86_64_GENERIC (validated — see fix_build.log; all 15 fixes compile cleanly in one batched build, rc=0).

Tested kernels

• baseline: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
• patched : DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64