DF-1445
ttm_mem_type_from_place omits upper-bound check vs TTM_NUM_MEM_TYPES before indexing bdev->man[8]
Summary
ttm_mem_type_from_place at ttm_bo.c:62: mem_type=ffs(flags&0xFFFF)-1 range 0-15. TTM_NUM_MEM_TYPES=8, bdev->man[8]. No check pos-1<8. Callers :998/:1047 index bdev->man[mem_type]. mem_type>=8 -> OOB read. No in-tree driver sets MEM bit>=8 (amdgpu max 5, radeon 0-3). Defense-in-depth. Fix: check pos-1<TTM_NUM_MEM_TYPES.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1445 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 393 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/drm/ttm/ttm_bo.c:62: ttm_mem_type_from_place omits upper-bound check before indexing man[8]
Verified recommended fix
Source-confirmed at sys/dev/drm/ttm/ttm_bo.c:62: ttm_mem_type_from_place omits upper-bound check before indexing man[8]
Verdict
Source-confirmed at sys/dev/drm/ttm/ttm_bo.c:62: ttm_mem_type_from_place omits upper-bound check before indexing man[8]
No comments yet.