UB left shift 1<<vmid in amdgpu_amdkfd_is_kfd_vmid lets out-of-range VMIDs pass KFD guard (latent: CONFIG_HSA_AMD not defined)
Summary
amdgpu_amdkfd_is_kfd_vmid L517 if((1<<vmid)&compute_vmid_bitmap) literal 1 is signed int; int<<int with shift>=32 is UB. No upper-bound check vmid (u32). On x86 shl masks count mod 32 so vmid 40/72/etc aliased to 8/15/.. falsely returns true. Downstream callers set_vm_context_page_table_base amdgpu_amdkfd_gfx_v8.c:844 WREG32(mmVM_CONTEXT8_PAGE_TABLE_BASE_ADDR+vmid-8,...) and gfx_v9.c:1031 WREG32(SOC15_REG_OFFSET(MMHUB,0,mmVM_CONTEXT0_PAGE_TABLE_BASE_ADDR_LO32)+(vmid*2),...) out-of-range VMIDs -> out-of-range MMIO offsets. LATENT: CONFIG_HSA_AMD not defined sys/dev/drm/kconfig.h:7-26 so adev->kfd always NULL is_kfd_vmid short-circuits false. Fix: vmid<32&&((1U<<vmid)&compute_vmid_bitmap).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1899 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 467 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 718 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1899 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: amdgpu_amdkfd_is_kfd_vmid L517 if((1<<vmid)&compute_vmid_bitmap) literal 1 is signed int; int<
Citation: sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:514-522
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: UB left shift 1<<vmid with no upper-bound check (amdgpu_amdkfd.c:514-522)
Verified recommended fix
Source-confirmed: UB left shift 1<<vmid with no upper-bound check (amdgpu_amdkfd.c:514-522)
Verdict
Source-confirmed: UB left shift 1<<vmid with no upper-bound check (amdgpu_amdkfd.c:514-522)
No comments yet.