smu_helper: latent infinite loop in phm_get_voltage_index and smu_get_voltage_dependency_table_ppt_v1 (uint8_t i vs uint32_t count)
Summary
phm_get_voltage_index 385-396: uint8_t count=(uint8_t)lookup_table->count; uint8_t i; for(i=0;i<lookup_table->count;i++). Assertion checks truncated uint8 count but loop compares i against original uint32 count. count=300 -> count truncated 44 assertion passes; i wraps 255->0 never exits. Same in smu_get_voltage_dependency_table_ppt_v1 679-685 uint8_t i vs uint32 count. Latent: VBIOS ucNumEntries u8 max 255. Fix: uint32_t i and i<count&&i<PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1799 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Use uint32_t i and cap iteration at PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES. | 802 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1799 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:385-396.
Mechanism
phm_get_voltage_index declares uint8_t count and i but loops i
Fix
Use uint32_t i and cap iteration at PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
powerplay sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- p
- o
- w
- e
- r
- p
- l
- a
- y
- /
- h
- w
- m
- g
- r
- /
- s
- m
- u
- _
- h
- e
- l
- p
- e
- r
- .
- c
- :
- 3
- 8
- 5
- -
- 3
- 9
- 6
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:385-396. Fix compiled clean.
PoC changes
authored fix.diff: use uint32_t i + cap at MAX_ENTRIES
Verified recommended fix
Use uint32_t loop counter; cap iteration. Matches finding proposal.
Verdict
REPRODUCED (source-only). uint8_t i loops against uint32 count; count>255 wraps i never exits. Latent (VBIOS u8 max 255).
No comments yet.