• File: sys/dev/drm/radeon/atom.c
• Lines: 224, 225, 229, 501, 502, 505, 1182, 1184, 634, 1335
• Severity: High
• CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U:C:H/I:H/A:H
• CWE: CWE-787 Out-of-bounds Write
• Confidence: certain

Summary

The PS (parameter-space) operand reads/writes ctx->ps[idx] where idx is a raw byte (0–255) from the VBIOS bytecode with no bounds check.

ctx->ps points to the caller's parameter buffer, which is a small stack-local array (e.g. uint32_t ps[16] in atom_asic_init).

Any idx ≥ 16 is a kernel stack out-of-bounds read (info leak) or write (return-address overwrite). The ps_shift mechanism compounds this by advancing the base pointer on each nested table call.

Root cause

In atom_get_src_int ATOM_ARG_PS (atom.c:224-232): idx = U8(*ptr) (line 225) yields 0–255, then line 229 val = get_unaligned_le32((u32 *)&ctx->ps[idx]) dereferences params + idx*4 with no bounds check.

ctx->ps is set to the params argument at atom.c:1184 (ectx.ps = params).

At the top call level, params points to the caller's stack buffer — e.g. atom_asic_init declares uint32_t ps[16] (atom.c:1335, 64 bytes), atombios_crtc passes &args structs of similar small size (atombios_crtc.c:77).

For idx=255, the access is params + 1020 bytes past the 64-byte buffer — deep into the kernel stack.

The write path (atom_put_dst ATOM_ARG_PS, atom.c:501-506, line 505: ctx->ps[idx] = cpu_to_le32(val)) is identical: a controlled 32-bit write at a controlled stack offset.

Furthermore, atom_op_calltable passes ctx->ps + ctx->ps_shift (atom.c:634) to the called table, where ps_shift = ps/4 (atom.c:1182) and ps is the table-declared PS size from the VBIOS (atom.c:1176, masked to 0–127, so ps_shift = 0–31).

A table declaring ps=128 (ps_shift=32) shifts the called table's params base 128 bytes forward before any PS access, guaranteeing OOB even with idx=0.

The declared PS size is never validated against the actual params buffer size.

Threat

Crafted VBIOS delivers a command table whose bytecode contains a PS operand with a large index byte (e.g. 0x80).

On execution during atom_asic_init (boot-time GPU init, atom.c:1347) or any display operation, the read variant leaks ~1 KB of kernel stack contents (which may contain credential pointers, return addresses, or canaries), and the write variant overwrites the kernel stack with attacker-controlled values — including saved return addresses of the calling chain (atom_execute_table_scratch_unlocked → atom_execute_table → atom_asic_init → caller), giving RIP control and kernel code execution.

The written value is fully attacker-controlled via a preceding MOVE_IMM source operand.

Same threat model (evil PCIe / VM passthrough VBIOS). Stack writes at controlled offsets from a known base are the most reliable kernel privilege-escalation primitive.

Exploit / PoC

Craft a VBIOS command table N (ensuring cmd_table[4+2*N] is non-zero) with: header WS=0, PS=4 (small, to not alarm sanity).

Bytecode:

1. MOVE_PS to PS[0x80] — opcode byte for MOVE_PS is 0x02 (atom.c:1042 / atom-names.h:36), attr byte encodes dst=PS/DWORD (arg=1<<0... actually attr low 3 bits = ATOM_ARG_PS=1, bits[5:3]=ATOM_SRC_DWORD=0), followed by PS index byte 0x80, then source IMM dword = 0x41414141 (attacker value).

atom_asic_init passes a 16-dword ps buffer; PS[0x80] writes at offset 0x200 past the buffer on the kernel stack.

Trigger via atom_asic_init (automatic at GPU probe) — the write corrupts the stack frame of atom_asic_init's caller.

Observe: kernel panic on return (corrupted return address), or for a controlled demonstration, set the value to a known invalid address and confirm the fault RIP matches.

For a read leak proof: use COMPARE_PS with idx=0x80 to load a stack dword into cs_equal/cs_above, then branch on it via JUMP_EQUAL to a path with observable side effects (e.g. BEEP), leaking one bit per comparison — a timing/side-channel oracle for stack contents.

Recommended fix

Thread the actual parameter-buffer size through the call chain and validate idx against it. At minimum, cap idx at the table-declared PS size and reject ps_shift that would advance past the buffer:

--- a/sys/dev/drm/radeon/atom.c
+++ b/sys/dev/drm/radeon/atom.c
@@ -55,6 +55,7 @@ typedef struct {
    struct atom_context *ctx;
    uint32_t *ps, *ws;
    int ps_shift;
+   int ps_size;          /* max valid dword index into ps[] */
    uint16_t start;
--- a/sys/dev/drm/radeon/atom.c
+++ b/sys/dev/drm/radeon/atom.c
@@ -224,6 +225,10 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
    case ATOM_ARG_PS:
        idx = U8(*ptr);
        (*ptr)++;
+       if (idx >= ctx->ps_size) {
+           DRM_ERROR("ATOM: PS read index %u out of range (%u)\n", idx, ctx->ps_size);
+           return 0;
+       }
        val = get_unaligned_le32((u32 *)&ctx->ps[idx]);
@@ -501,6 +506,10 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr,
    case ATOM_ARG_PS:
        idx = U8(*ptr);
        (*ptr)++;
+       if (idx >= ctx->ps_size) {
+           DRM_ERROR("ATOM: PS write index %u out of range (%u)\n", idx, ctx->ps_size);
+           break;
+       }
        ctx->ps[idx] = cpu_to_le32(val);

And in atom_execute_table_locked, set ectx.ps_size to min(declared_ps/4, remaining params dwords), and verify ctx->ps + ps_shift does not exceed params + params_size before recursing in atom_op_calltable. The caller must pass params_size (add a parameter or store it in struct atom_context).

Related findings

• DF-1534 (sibling): unbounded recursion in atom_op_calltable.
• DF-1535 (sibling): integer overflow in FB scratch bounds check.
• DF-1537 (sibling): unbounded WS operand index + NULL deref.