Unchecked VBIOS conn_num drives OOB write past connectors[16] in update_slot_layout_info
Summary
update_slot_layout_info at bios_parser2.c:1732: num_of_connectors=record->conn_num (u8 from VBIOS). connectors[MAX_CONNECTOR_NUMBER_PER_SLOT=16]. conn_info[1]. No check conn_num<=16. conn_num>16 -> OOB write past connectors into board_layout_info/adjacent heap. Sibling of bios_parser.c DF-1298. Crafted VBIOS. Fix: check conn_num<=MAX_CONNECTOR_NUMBER_PER_SLOT.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1413 · 12 files| File | Type | Description | Size | |
|---|---|---|---|---|
| harness.c | trigger-source | userspace replica of update_slot_layout_info with VBIOS conn_num>16 -> connectors[16] OOB | 5.3 KB | view raw |
| build.sh | build-script | cc -O2 -Wall -o harness harness.c | 107 B | view raw |
| run.sh | run-script | ./harness | 60 B | view raw |
| build.log | build-log | final successful build, full output | 78 B | view raw |
| run.log | run-log | decisive run, full output | 847 B | view raw |
| fix.diff | suggested-fix | clamp num_of_connectors to MAX_CONNECTOR_NUMBER_PER_SLOT after assignment | 886 B | view raw |
| fix_module_proof.txt | fix-build-proof | bios_parser2.o produced, amdgpu.ko linked, 0 errors | 269 B | view raw |
| fix_module_build.log | fix-build-log | module build excerpt under -Werror | 16.5 KB | view raw |
| env.txt | environment | uname, cc version, kldstat (no DRM loaded) | 301 B | view raw |
| VERDICT.md | verdict | full narrative: mechanism, reachability, harness, fix | 1.9 KB | ↓ raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-1413 — Unchecked VBIOS conn_num -> OOB write past connectors[16]
Verdict: REPRODUCED (source-level + harness) — latent amdgpu-display bug, heap OOB write
The bug
sys/dev/drm/amd/display/dc/bios/bios_parser2.c, function
update_slot_layout_info, lines 1732-1768:
slot_layout_info->num_of_connectors = record->conn_num; /* :1732 -- u8 VBIOS */
for (j = 0; j < slot_layout_info->num_of_connectors; ++j) {
slot_layout_info->connectors[j].connector_type = ...; /* :1734 -- OOB */
...
}
conn_num is a u8 (0..255) taken directly from the VBIOS record with no
check against MAX_CONNECTOR_NUMBER_PER_SLOT (16)
(grph_object_defs.h:40,172). With conn_num > 16 the writes overflow
connectors[16] into the rest of struct slot_layout_info /
board_layout_info and the adjacent heap. The same pattern exists in
bios_parser.c:2654 (ucConnNum). Crafted VBIOS on driver attach / display
init.
Harness proof
VBIOS record->conn_num = 255 (u8, no bounds check)
MAX_CONNECTOR_NUMBER_PER_SLOT = 16
overflow slots = 239 past connectors[16]
connectors[16] = {type=1 len=10} <-- FIRST OOB WRITE
RESULT: heap OOB write CONFIRMED at bios_parser2.c:1734
Fix
fix.diff clamps num_of_connectors to MAX_CONNECTOR_NUMBER_PER_SLOT
after the assignment from record->conn_num and before the loop.
Module build validation (Phase 8)
All 8 amdgpu fixes applied; amdgpu.ko built under -Werror:
bios_parser2.o (13384 bytes) produced, 0 errors, amdgpu.ko (3741488
bytes) linked. See fix_module_proof.txt / fix_module_build.log.
Note: the finding DB record cites bios_parser2.c:1732 (conn_num);
the run-prompt table header says bios_parser.c. Both files contain the same
bug pattern (bios_parser.c:2654 uses ucConnNum); the cited line 1732 is
in bios_parser2.c, which is what this verification targets.
Fix verification
fixedVALIDATED via module build: fix.diff applied cleanly; amdgpu.ko built under -Werror with 0 errors; bios_parser2.o (13384 bytes) produced, amdgpu.ko linked. Runtime before/after not possible (no AMD GPU HW).
baseline (harness): connectors[16] = {type=1 len=10} <-- FIRST OOB WRITE
patched (module build): OK bios_parser2.o (13384 bytes); amdgpu.ko = 3741488 bytes; error count: 0; AMDGPU_DONE
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- d
- c
- /
- b
- i
- o
- s
- /
- b
- i
- o
- s
- _
- p
- a
- r
- s
- e
- r
- 2
- .
- c
- :
- 1
- 7
- 3
- 2
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- d
- c
- /
- b
- i
- o
- s
- /
- b
- i
- o
- s
- _
- p
- a
- r
- s
- e
- r
- 2
- .
- c
- :
- 1
- 7
- 3
- 4
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- i
- n
- c
- l
- u
- d
- e
- /
- g
- r
- p
- h
- _
- o
- b
- j
- e
- c
- t
- _
- d
- e
- f
- s
- .
- h
- :
- 4
- 0
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- i
- n
- c
- l
- u
- d
- e
- /
- g
- r
- p
- h
- _
- o
- b
- j
- e
- c
- t
- _
- d
- e
- f
- s
- .
- h
- :
- 1
- 7
- 2
Detail
Exploit chain
Blocked by dead-code-on-guest hard blocker (valid): amdgpu/display module not in X86_64_GENERIC and no AMD GPU HW on the guest; kernel path cannot trigger end-to-end. Primitive proven at harness level (connectors[16] OOB). Realistic runtime impact with amdgpu HW + crafted VBIOS is memory corruption / panic on display init. Evidence pack: findings/poc/DF-1413/ (harness.c).
Evidence (decisive lines)
VBIOS record->conn_num = 255 (u8, no bounds check)
MAX_CONNECTOR_NUMBER_PER_SLOT = 16
overflow slots = 239 past connectors[16]
connectors[15] = {type=1 len=10} (in-bounds, last legal slot)
connectors[16] = {type=1 len=10} <-- FIRST OOB WRITE
connectors[17] = {type=1 len=10} <-- OOB
RESULT: heap OOB write CONFIRMED at bios_parser2.c:1734
RUN_EXIT=0
PoC changes
Authored harness.c, build.sh, run.sh, fix.diff (clamp num_of_connectors to MAX_CONNECTOR_NUMBER_PER_SLOT after assignment), VERDICT.md, manifest.json. fix.diff regenerated via copy+edit+diff for correct hunk headers.
Verified recommended fix
In update_slot_layout_info (bios_parser2.c), after num_of_connectors = record->conn_num; add if (num_of_connectors > MAX_CONNECTOR_NUMBER_PER_SLOT) num_of_connectors = MAX_CONNECTOR_NUMBER_PER_SLOT;. Matches finding proposal. The same fix should be applied at bios_parser.c:2654 (ucConnNum). Full diff in findings/poc/DF-1413/fix.diff.
Verdict
REPRODUCED. update_slot_layout_info (bios_parser2.c:1732-1768) sets num_of_connectors = record->conn_num (u8 from VBIOS) with NO bound check, then loops writing connectors[j] (grph_object_defs.h:172, fixed [MAX_CONNECTOR_NUMBER_PER_SLOT=16]). With conn_num>16 the writes overflow connectors[16] into board_layout_info / adjacent heap. Confirmed by harness: connectors[16] clobbered. NOTE: DB cites bios_parser2.c:1732 (conn_num); the run-prompt header said bios_parser.c — the cited line 1732 is in bios_parser2.c, which is what this targets. bios_parser.c:2654 has the same bug (ucConnNum).
No comments yet.