amdgpu_gem: GEM_CREATE GDS-domain ALIGN(size,4) wrap to zero produces zero-size GEM object
Summary
amdgpu_gem_create_ioctl at amdgpu_gem.c:248-249: if (args->in.domains & AMDGPU_GEM_DOMAIN_GDS) size = ALIGN(size, 4) = roundup2 = (size+3)&~3. For size=0xFFFFFFFFFFFFFFFD: size+3 wraps to 0xFFFE masked to 0. Wrapped 0 propagates amdgpu_gem_object_create->amdgpu_bo_create->amdgpu_bo_do_create. GDS amdgpu_bo_validate_size returns true unconditionally (amdgpu_object.c:411). drm_gem_private_object_init/ttm_bo_init_reserved receive size=0. NO_CPU_ACCESS forced at 246 prevents mmap. Unpriv render-node; AMDGPU_GEM_CREATE bo_size near UINT64_MAX domains=GDS -> valid handle bo_size=0 reported via GEM_OP GET. Accounting/logic confusion; building block not directly privesc.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1721 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Reject size > UINT64_MAX-3 before ALIGN. | 527 B | view raw |
| VERDICT.md | verdict | full analysis | 1.0 KB | ↓ raw |
DF-1721 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: none Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/amd/amdgpu/amdgpu_gem.c:248-249.
Mechanism
amdgpu_gem_create_ioctl GDS ALIGN(size,4) wraps to 0 for size near UINT64_MAX; zero-size BO created with valid handle, accounting confusion.
Fix
Reject size > UINT64_MAX-3 before ALIGN.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
amdgpu sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- a
- m
- d
- g
- p
- u
- /
- a
- m
- d
- g
- p
- u
- _
- g
- e
- m
- .
- c
- :
- 2
- 4
- 8
- -
- 2
- 4
- 9
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/amd/amdgpu/amdgpu_gem.c:248-249. Fix compiled clean.
PoC changes
authored fix.diff: reject size > UINT64_MAX-3 before ALIGN
Verified recommended fix
Reject size > UINT64_MAX-3 before ALIGN. Matches finding proposal.
Verdict
REPRODUCED (source-only). GDS ALIGN(size,4) wraps to 0 for size near UINT64_MAX; zero-size BO with valid handle.
No comments yet.