smu_helper: phm_get_lowest_enabled_level infinite-loops when mask==0
Summary
phm_get_lowest_enabled_level 520-527: uint32_t level=0; while(0==(mask&(1<<level))) level++; NO upper bound on level NO mask==0 check. level>=32 UB shift. Current callers smu7_hwmgr.c:2695/2705/2715 pre-check mask!=0. Latent if future caller omits check. Fix: if(mask==0) return 0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1800 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add mask==0 early return. | 335 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1800 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:520-527.
Mechanism
phm_get_lowest_enabled_level while(mask&(1<
Fix
Add mask==0 early return.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
powerplay sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- p
- o
- w
- e
- r
- p
- l
- a
- y
- /
- h
- w
- m
- g
- r
- /
- s
- m
- u
- _
- h
- e
- l
- p
- e
- r
- .
- c
- :
- 5
- 2
- 0
- -
- 5
- 2
- 7
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:520-527. Fix compiled clean.
PoC changes
authored fix.diff: add mask==0 early return
Verified recommended fix
Add mask==0 early return. Matches finding proposal.
Verdict
REPRODUCED (source-only). while(mask&(1<
No comments yet.