ttm_bo_util: ttm_bo_kmap bounds check allows OOB page-array index
Summary
ttm_bo_kmap at 610-613: if (num_pages > bo->num_pages) return EINVAL; if (start_page > bo->num_pages) return EINVAL. Second check uses > not >= and does not combine args. Valid access requires start_page + num_pages <= bo->num_pages. Current test accepts (start_page=bo->num_pages, num_pages=1) making ttm_bo_kmap_ttm read ttm->pages[bo->num_pages] (584) or vmap(ttm->pages+bo->num_pages, 1, ...) (593). Also accepts (start_page=bo->num_pages-1, num_pages=2) -> vmap reads 2 pointers starting at bo->num_pages-1 one past end. Latent: in-tree callers pass (0, bo->num_pages) or single in-range page (amdgpu_bo_kmap, radeon_object.c:281, amdgpu_prime.c:75, radeon_prime.c:58, ttm_bo_vm_access_kmap pre-checked). Fix: start_page + num_pages > bo->num_pages.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1746 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.6 KB | ↓ raw |
| fix.diff | suggested-fix | Validate num_pages > 0 and start_page+num_pages <= ttm->num_pages at function en | 566 B | view raw |
| ../fix_build_new.log | build-log | Batch kernel build with new fixes (rc=0, -Werror) | 5.6 MB | ↓ download |
DF-1746 — PoC Verification Verdict
Category: drm (module / HW-gated)
Source: sys/dev/drm/ttm/ttm_bo_util.c:584-613
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-25
Verdict: REPRODUCED (source-only confirmation; HW/module-gated)
Mechanism
ttm_bo_kmap validates start_page+num_pages <= ttm->num_pages but the vmap path uses ttm->pages + start_page with num_pages — caller can pass num_pages=0 causing underflow in /sizeof(uint32_t) loop math, or pass values causing OOB into pages array.
In GENERIC kernel build: NO (module / not compiled into X86_64_GENERIC on audit QEMU guest)
Reproduction status
This finding is hardware/module gated: the vulnerable code path requires specific hardware (AMD GPU / radeon / Atheros NIC / RAID controller) or a loadable module not present on the audit QEMU guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Validate num_pages > 0 and start_page+num_pages <= ttm->num_pages at function entry.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): ttm_bo_kmap validates num_pages and start_page against bo->num_pages in two separate checks; combined start_page+num_pages > num_pages case slips through, allowing OOB into p
Verified recommended fix
REPRODUCED (source-only): ttm_bo_kmap validates num_pages and start_page against bo->num_pages in two separate checks; combined start_page+num_pages > num_pages case slips through, allowing OOB into pages array.
Verdict
REPRODUCED (source-only): ttm_bo_kmap validates num_pages and start_page against bo->num_pages in two separate checks; combined start_page+num_pages > num_pages case slips through, allowing OOB into pages array.
No comments yet.