NULL deref in smu8_construct_max_power_limits_table when VBIOS omits SCLK dependency table
Summary
smu8_construct_max_power_limits_table at smu8_hwmgr.c:259: dep_table=vddc_dependency_on_sclk (NULL if VBIOS omits usVddcDependencyOnSCLKOffset). :262 dep_table->count derefs NULL -> panic at driver init. Crafted/corrupt VBIOS. Fix: check dep_table!=NULL.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1419 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.1 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 856 B | view raw |
DF-1419 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
NULL deref in smu8_construct_max_power_limits_table when VBIOS omits SCLK dependency table
Source Location
sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:259-265
Verdict
Source-confirmed: NULL deref in smu8_construct_max_power_limits_table when VBIOS omits S. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
smu8_construct_max_power_limits_table at smu8_hwmgr.c:259: dep_table=vddc_dependency_on_sclk (NULL if VBIOS omits usVddcDependencyOnSCLKOffset). :262 dep_table->count derefs NULL -> panic at driver init. Crafted/corrupt VBIOS. Fix: check dep_table!=NULL.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: smu8_construct_max_power_limits_table dereferences dep_table->count without checking dep_table!=NULL when VBIOS omits SCLK dependency table. Added NULL check. HW-gated.
Verified recommended fix
Source-confirmed: smu8_construct_max_power_limits_table dereferences dep_table->count without checking dep_table!=NULL when VBIOS omits SCLK dependency table. Added NULL check. HW-gated.
Verdict
Source-confirmed: smu8_construct_max_power_limits_table dereferences dep_table->count without checking dep_table!=NULL when VBIOS omits SCLK dependency table. Added NULL check. HW-gated.
No comments yet.