amdgpu_fence: power-of-two check accepts 0 -> kcalloc(0) returns ZERO_LENGTH_PTR -> NULL deref panic on first emit
Summary
amdgpu_fence_driver_init_ring at 424: if ((num_hw_submission & (num_hw_submission - 1)) != 0) power-of-two idiom accepts 0 (0 & UINT_MAX == 0). num_hw_submission=0: 435 num_fences_mask = 0*2-1 = UINT_MAX; 437 kcalloc(0,...) -> kzalloc(0) -> kmalloc(0) returns ZERO_LENGTH_PTR ((void*)-8) non-NULL; 439 !fences check fails. First amdgpu_fence_emit: 155 ptr=&fences[seq & UINT_MAX]=&fences[1]=(void*)-8+8=NULL; 159 rcu_dereference_protected(*ptr,1) derefs NULL panic. sched_hw_submission settable only at modprobe/kernel-cmdline (CAP_SYS_MODULE root). KIQ ring max()d with 256 safe; all other rings vulnerable. Fix: !num_hw_submission || !is_power_of_2(num_hw_submission).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1807 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add !num_hw_submission to the validation check. | 465 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1807 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/amd/amdgpu/amdgpu_fence.c:424,435.
Mechanism
amdgpu_fence_driver_init_ring power-of-two check (n&(n-1)) accepts 0; num_hw_submission=0 yields num_fences_mask=UINT_MAX, kcalloc(0)=ZERO_LENGTH_PTR non-NULL, first fence emit derefs NULL.
Fix
Add !num_hw_submission to the validation check.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
amdgpu sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- a
- m
- d
- g
- p
- u
- /
- a
- m
- d
- g
- p
- u
- _
- f
- e
- n
- c
- e
- .
- c
- :
- 4
- 2
- 4
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- a
- m
- d
- g
- p
- u
- /
- a
- m
- d
- g
- p
- u
- _
- f
- e
- n
- c
- e
- .
- c
- :
- 4
- 3
- 5
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/amd/amdgpu/amdgpu_fence.c:424,435. Fix compiled clean.
PoC changes
authored fix.diff: add !num_hw_submission to check
Verified recommended fix
Add !num_hw_submission to power-of-two validation. Matches finding proposal.
Verdict
REPRODUCED (source-only). Power-of-two check accepts 0; num_hw_submission=0 -> kcalloc(0)=ZERO_LENGTH_PTR, first fence emit derefs NULL.
No comments yet.