Summary

psp_v3_1_init_microcode reads ucode_array_offset_bytes, ucode_size_bytes, sos_offset_bytes, and sos_size_bytes directly out of the firmware blob and uses them as pointer offsets and memcpy lengths without any bounds check. amdgpu_ucode_validate (amdgpu_ucode.c:251-260) only verifies fw->datasize == hdr->size_bytes, so all internal fields are attacker-controlled. The unsigned subtraction sys_bin_size = ucode_size_bytes - sos_size_bytes underflows to ~4 GiB when sos_size_bytes > ucode_size_bytes; sys_start_addr / sos_start_addr are computed by adding unverified offsets to the blob base. The resulting values are later consumed as memcpy lengths into the fixed 1 MiB fw_pri_buf in psp_v3_1_bootloader_load_sysdrv (line 195) and psp_v3_1_bootloader_load_sos (line 255), producing a kernel heap overflow write and an OOB read on the firmware object.

Root cause

psp_v3_1.c:130-139:

hdr = (const struct psp_firmware_header_v1_0 *)adev->psp.sos_fw->data;
adev->psp.sos_fw_version  = le32_to_cpu(hdr->header.ucode_version);
adev->psp.sos_feature_version = le32_to_cpu(hdr->ucode_feature_version);
adev->psp.sos_bin_size    = le32_to_cpu(hdr->sos_size_bytes);
adev->psp.sys_bin_size    = le32_to_cpu(hdr->header.ucode_size_bytes) -
                            le32_to_cpu(hdr->sos_size_bytes);   /* uint32_t subtraction, no overflow check */
adev->psp.sys_start_addr  = (uint8_t *)hdr +
                            le32_to_cpu(hdr->header.ucode_array_offset_bytes);   /* no check vs fw->datasize */
adev->psp.sos_start_addr  = (uint8_t *)adev->psp.sys_start_addr +
                            le32_to_cpu(hdr->sos_offset_bytes);                  /* no check vs fw->datasize */

hdr->header is the common_firmware_header (amdgpu_ucode.h:26-37); ucode_size_bytes / ucode_array_offset_bytes are 32-bit fields. The only validation done before this code runs is amdgpu_ucode_validate (amdgpu_ucode.c:251), which compares only the outer size_bytes field to fw->datasize and returns 0 — it never checks the inner layout fields.

Both sys_bin_size and sos_bin_size are stored into the psp_context as raw uint32_t (amdgpu_psp.h:108-109).

The same defect exists for the ASD blob at psp_v3_1.c:150-155 (asd_ucode_size from hdr->header.ucode_size_bytes; asd_start_addr from ucode_array_offset_bytes), consumed later by amdgpu_psp.c:254-255 memcpy(psp->fw_pri_buf, psp->asd_start_addr, psp->asd_ucode_size).

Later, in psp_v3_1_bootloader_load_sysdrv (psp_v3_1.c:192-195):

memset(psp->fw_pri_buf, 0, PSP_1_MEG);
memcpy(psp->fw_pri_buf, psp->sys_start_addr, psp->sys_bin_size);

fw_pri_buf is allocated as exactly PSP_1_MEG (0x100000) at amdgpu_psp.c:350-354. If sys_bin_size was set via the underflow to, say, 0xFFFFFF00, the memcpy writes ~4 GiB into a 1 MiB buffer and reads past the firmware object. Identical pattern at psp_v3_1.c:252-255 for the SOS binary.

Threat model & preconditions

• Attacker position: write access to the firmware image used by the amdgpu driver for VEGA10/VEGA12 (e.g. /boot/modules firmware, or any path firmware_get() can resolve on DragonFlyBSD — request_firmware at sys/dev/drm/include/linux/firmware.h:39 calls firmware_get(name)). This normally requires root (kldload-equivalent privilege).
• Privileges gained or impact: kernel heap corruption — memcpy writes past the 1 MiB fw_pri_buf GTT buffer, corrupting adjacent slab objects and reading past the firmware object. Floor: deterministic kernel panic on every GPU init / resume / GPU-reset-recovery path (psp_load_fw / psp_hw_start).
• Required config or capabilities: device amdgpu on VEGA10/VEGA12; ability to write the firmware image (root) or trigger a GPU reset that recovers through psp_load_fw. The corruption is reached on every init.
• Reachability: any user who can trigger a GPU reset can leverage a pre-planted corrupt firmware to turn a noisy GPU fault into deterministic kernel heap corruption. On systems where firmware is delivered out-of-band (network provisioning, vendor-signed-but-malformed blobs, filesystem corruption), the kernel must not trust inner-header fields even when the outer size matches.

Proof of concept

PoC source: findings/poc/DF-1838/gen_fw.py

Build & run

python3 gen_fw.py
# Install as the SOS firmware used by the driver (path resolved by
# firmware_get("amdgpufw_vega10_sos")). Then reboot with VEGA10/VEGA12
# hardware present, or kldload amdgpu, or trigger a GPU reset recovery.

Expected output

kernel page-fault / panic in memcpy called from psp_v3_1_bootloader_load_sysdrv
destination = psp->fw_pri_buf, length ≈ 0xFFFFFF00
OR
deterministic heap corruption adjacent to the 1 MiB GTT buffer

Reproducer should be run on bare metal or with PCI passthrough of a VEGA10 device; the absence of the hardware makes end-to-end panic verification environment-dependent, but the memory-corruption primitive is provable by inspection of the cited lines.

Impact

Low-severity because the trigger is root-only (firmware write). The corruption is deterministic on every PSP init for a planted malformed firmware, and turns a GPU reset into deterministic kernel heap corruption for any user able to trigger the reset. Defense-in-depth: the kernel must not trust inner-header fields even when the outer size matches.

Recommended fix

Validate every inner firmware-header field against fw->datasize before dereferencing or copying.

--- a/sys/dev/drm/amd/amdgpu/psp_v3_1.c
+++ b/sys/dev/drm/amd/amdgpu/psp_v3_1.c
@@ -101,6 +101,7 @@ static int psp_v3_1_init_microcode(struct psp_context *psp)
    struct amdgpu_device *adev = psp->adev;
    const char *chip_name;
    char fw_name[30];
+   size_t fw_size;
    int err = 0;
    const struct psp_firmware_header_v1_0 *hdr;

@@ -126,10 +127,17 @@ static int psp_v3_1_init_microcode(struct psp_context *psp)
    err = amdgpu_ucode_validate(adev->psp.sos_fw);
    if (err)
        goto out;

+   fw_size = adev->psp.sos_fw->datasize;
+   if (fw_size < sizeof(*hdr)) { err = -EINVAL; goto out; }
    hdr = (const struct psp_firmware_header_v1_0 *)adev->psp.sos_fw->data;
+   /* Reject underflow / OOB in the SOS header layout */
+   if (le32_to_cpu(hdr->header.ucode_size_bytes) < le32_to_cpu(hdr->sos_size_bytes) ||
+       (size_t)le32_to_cpu(hdr->header.ucode_array_offset_bytes) +
+               le32_to_cpu(hdr->header.ucode_size_bytes) > fw_size ||
+       (size_t)le32_to_cpu(hdr->header.ucode_array_offset_bytes) +
+               le32_to_cpu(hdr->sos_offset_bytes) +
+               le32_to_cpu(hdr->sos_size_bytes) > fw_size) {
+       err = -EINVAL; goto out;
+   }
    adev->psp.sos_fw_version = le32_to_cpu(hdr->header.ucode_version);
    adev->psp.sos_feature_version = le32_to_cpu(hdr->ucode_feature_version);
    adev->psp.sos_bin_size = le32_to_cpu(hdr->sos_size_bytes);
@@ -146,10 +154,18 @@ static int psp_v3_1_init_microcode(struct psp_context *psp)
    err = amdgpu_ucode_validate(adev->psp.asd_fw);
    if (err)
        goto out;

+   fw_size = adev->psp.asd_fw->datasize;
+   if (fw_size < sizeof(*hdr)) { err = -EINVAL; goto out; }
    hdr = (const struct psp_firmware_header_v1_0 *)adev->psp.asd_fw->data;
+   /* Reject OOB in the ASD header layout */
+   if ((size_t)le32_to_cpu(hdr->header.ucode_array_offset_bytes) +
+               le32_to_cpu(hdr->header.ucode_size_bytes) > fw_size) {
+       err = -EINVAL; goto out;
+   }
    adev->psp.asd_fw_version = le32_to_cpu(hdr->header.ucode_version);
    adev->psp.asd_feature_version = le32_to_cpu(hdr->ucode_feature_version);
    adev->psp.asd_ucode_size = le32_to_cpu(hdr->header.ucode_size_bytes);

Hardening (not strictly required): clamp sys_bin_size / sos_bin_size / asd_ucode_size to PSP_1_MEG before the memcpy in psp_v3_1_bootloader_load_sysdrv (line 195), psp_v3_1_bootloader_load_sos (line 255), and amdgpu_psp.c:255, so a future caller cannot overflow the 1 MiB fw_pri_buf even if the header check is bypassed.

References

• Outer-size-only validation: amdgpu_ucode_validate amdgpu_ucode.c:251-260.
• Destination size: amdgpu_psp.c:350-354 (PSP_1_MEG).
• Sibling firmware-header validation patterns (PowerPlay, VCN) are similarly undersized — see DF-1468–1472 (processpptables.c), DF-1689/1690 (vega20_processpptables.c), DF-1815–1817 (ppatomfwctrl.c).

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).