β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-1897

mmhub_v1_0_get_clockgating missing return on SR-IOV VF path reads host-managed registers

Summary

mmhub_v1_0_get_clockgating L552-553 if(amdgpu_sriov_vf(adev))*flags=0; no return after. Sibling mmhub_v1_0_set_clockgating L524-525 correctly if(amdgpu_sriov_vf(adev))return 0; Getter falls through L556-563 RREG32_SOC15(ATHUB,0,mmATHUB_MISC_CNTL) and RREG32_SOC15(MMHUB,0,mmATC_L2_MISC_CG) on VF and ORs bits into *flags defeating intended VF bypass. Impact bounded: SR-IOV VF MMIO to host-owned MMHUB/ATHUB registers trapped/emulated by host PF no host kernel memory leak; only consumer in-kernel CG state machine. Worst: incorrect CG state on VF itself self-DoS of guest GPU not cross-tenant/privilege/memory. Defense-in-depth. Fix: add return after *flags=0 for VF mirroring set_clockgating.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1897 Β· 1 files
FileTypeDescriptionSize
manifest.json file 401 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:548: missing return on SR-IOV VF path reads host-managed registers

Verified recommended fix

Source-confirmed at sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:548: missing return on SR-IOV VF path reads host-managed registers

Verdict

Source-confirmed at sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:548: missing return on SR-IOV VF path reads host-managed registers