• File: sys/dev/drm/amd/powerplay/hwmgr/processpptables.c
• Lines: 61–62, 162–163, 227–228, 263–264, 299–300, 350–351, 875–876, 910–911, 917–921, 1029–1030, 1279–1284, 1291–1293, 1305–1307, 1313–1315, 1321–1323, 1329–1331, 1348–1350, 1360–1361, 1473–1475, 1485–1487, 1492–1493, 1512–1515, 1571–1574
• Severity: High
• CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• CWE: CWE-787 Out-of-bounds Write
• Confidence: certain

Summary

Throughout processpptables.c, VBIOS-supplied USHORT offsets (usExtendendedHeaderOffset, usStateArrayOffset, usClockInfoArrayOffset, usNonClockInfoArrayOffset, usVCETableOffset, usUVDTableOffset, usSAMUTableOffset, usACPTableOffset, usPowerTuneTableOffset, usSclkVddgfxTableOffset, usVddcDependencyOnSCLKOffset, usCACLeakageTableOffset, usPPMTableOffset, usVddcPhaseShedLimitsTableOffset, etc.) are added to (unsigned long)powerplay_table and the result is immediately dereferenced as a typed pointer. No offset is ever checked to lie within [0, hwmgr->soft_pp_table_size) nor, for compound walks (lines 75–148), to keep the cumulative pointer inside the image. A crafted VBIOS can set any of these to 0xFFFF, pointing 65535 bytes past the table base.

Root cause

Every ... = (... *)(((unsigned long)powerplay_table) + le16_to_cpu(...offset)) site lacks bounds. Representative examples:

• Extended-header deref at processpptables.c:59-62 (and duplicated at 160-163, 225-228, 261-264, 297-300, 348-351, 1485-1487, 1029-1030).
• StateArray/ClockInfoArray/NonClockInfoArray derefs at processpptables.c:875-876, 910-911, 917-921.
• Per-sub-table derefs at processpptables.c:1230-1235 (VCE), 1245-1250 (UVD), 1259-1261 (SAMU), 1270-1272 (ACP), 1279-1284 / 1291-1293 (PowerTune), 1305-1307 / 1313-1315 / 1321-1323 / 1329-1331 / 1348-1350 (POWERPLAYTABLE4 dependency offsets), 1360-1361 (sclk_vdd_gfx), 1473-1475 (CAC leakage), 1492-1493 (PPM), 1512-1515 (phase shed), 1571-1574 (VCE clock info array and clock info array).

The cumulative table walker at processpptables.c:75-148 (get_vce_clock_info_array_offset/_size, get_vce_clock_voltage_limit_table_offset/_size, get_vce_state_table_offset) blindly chains offsets and p->ucNumEntries * sizeof(...) sizes — each term VBIOS-controlled — without ever checking that the running total still lies inside soft_pp_table_size.

usExtendendedHeaderOffset is even compared only with > 0 (processpptables.c:58, 159, 224, 260, 296, 347) — a non-zero value of any size passes.

Threat

Same local/VBIOS position as DF-1468/1469. A single malicious USHORT offset (e.g. usExtendendedHeaderOffset = 0xFFFF in a v3+ table) makes the extended-header pointer land ~64 KB past the PowerPlay table base. The kernel then reads usSize, usVCETableOffset, etc. from arbitrary kernel memory, dereferences those values as further offsets, and so on — a single bad offset cascades into arbitrary-read-then-corrupt chains.

Because the walker at lines 75–148 sums multiple VBIOS-supplied sizes, the cumulative offset can wrap modulo 2^64 only at extreme UCHAR products, but the practical case (offset near image end + small counts) is trivially reachable and lands reads/writes in adjacent kernel pages.

Exploit / PoC

Same atom-table mutator as DF-1468. Forge a PowerPlayInfo atom table of real size ~256 bytes; set usTableSize = sizeof(ATOM_PPLIB_POWERPLAYTABLE3) to pass the version check at processpptables.c:53-54, then set usExtendendedHeaderOffset = 0xFFFF. On driver attach, get_vce_table_offset (line 62) computes powerplay_table + 0xFFFF and dereferences extended_header->usSize (line 63) from kernel memory 64 KB past the table.

Expected observable: kernel page fault at smu_atom_.../get_vce_table_offset during amdgpu init, or — with the adjacent 64 KB mapped — chained derefs producing clearly garbled vce_table_offset values that drive a secondary fault deeper in init_clock_voltage_dependency.

Recommended fix

Centralize all VBIOS pointer arithmetic behind one helper that rejects OOB offsets:

--- a/sys/dev/drm/amd/powerplay/hwmgr/processpptables.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/processpptables.c
@@ -46,6 +46,21 @@

 #define NUM_BITS_CLOCK_INFO_ARRAY_INDEX 6

+/*
+ * Resolve a VBIOS-supplied USHORT offset relative to the PowerPlay table
+ * base. Returns NULL if (offset, want) runs outside soft_pp_table_size,
+ * which every caller MUST check before dereferencing.
+ */
+static const void *pp_table_ptr(const struct pp_hwmgr *hwmgr,
+               const ATOM_PPLIB_POWERPLAYTABLE *tbl,
+               uint16_t offset, size_t want)
+{
+   unsigned long base = (unsigned long)hwmgr->soft_pp_table;
+   unsigned long p    = base + offset;
+   if (offset >= hwmgr->soft_pp_table_size ||
+       want > hwmgr->soft_pp_table_size - offset)
+       return NULL;
+   return (const void *)p;
+}

Replace every (((unsigned long)powerplay_table) + le16_to_cpu(off)) site listed in root_cause with pp_table_ptr(hwmgr, powerplay_table, le16_to_cpu(off), sizeof(*target)), abort the containing init_* function with -EINVAL when it returns NULL. This single refactor closes DF-1468, DF-1469, and DF-1470 simultaneously.

Related findings

• DF-1468 (sibling): unbounded per-record index into clock-info arrays.
• DF-1469 (sibling): inflated ucNumEntries count OOB.
• Part of the recurring "VBIOS offset/index OOB" family.