mmhub_v1_0_get_clockgating missing return on SR-IOV VF path reads host-managed registers
Summary
mmhub_v1_0_get_clockgating L552-553 if(amdgpu_sriov_vf(adev))*flags=0; no return after. Sibling mmhub_v1_0_set_clockgating L524-525 correctly if(amdgpu_sriov_vf(adev))return 0; Getter falls through L556-563 RREG32_SOC15(ATHUB,0,mmATHUB_MISC_CNTL) and RREG32_SOC15(MMHUB,0,mmATC_L2_MISC_CG) on VF and ORs bits into *flags defeating intended VF bypass. Impact bounded: SR-IOV VF MMIO to host-owned MMHUB/ATHUB registers trapped/emulated by host PF no host kernel memory leak; only consumer in-kernel CG state machine. Worst: incorrect CG state on VF itself self-DoS of guest GPU not cross-tenant/privilege/memory. Defense-in-depth. Fix: add return after *flags=0 for VF mirroring set_clockgating.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1897 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 401 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:548: missing return on SR-IOV VF path reads host-managed registers
Verified recommended fix
Source-confirmed at sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:548: missing return on SR-IOV VF path reads host-managed registers
Verdict
Source-confirmed at sys/dev/drm/amd/amdgpu/mmhub_v1_0.c:548: missing return on SR-IOV VF path reads host-managed registers
No comments yet.