DF-1627
UB: 1<<session_idx executed before no-session guard when session_idx==-1
Summary
amdgpu_vce.c:812 created|=1<<session_idx. 865 destroyed|=1<<session_idx. session_idx init -1 (712). Guard at 908 after switch. If create/destroy first cmd no session -> 1<<-1 UB C99/C11. x86 yields 1<<31 harmless but compiler may exploit UB eliding post-switch guard. Forward-looking risk. Fix: check session_idx before switch.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1627 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 401 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/drm/amd/amdgpu/amdgpu_vce.c:812: UB 1<<session_idx before no-session guard when session_idx==-1
Verified recommended fix
Source-confirmed at sys/dev/drm/amd/amdgpu/amdgpu_vce.c:812: UB 1<<session_idx before no-session guard when session_idx==-1
Verdict
Source-confirmed at sys/dev/drm/amd/amdgpu/amdgpu_vce.c:812: UB 1<<session_idx before no-session guard when session_idx==-1
No comments yet.