Stubbed get_local_mem_info returns uninitialized output structure: latent info-leak if KFD wired up (CONFIG_HSA_AMD not defined)
Summary
get_local_mem_info L354-387 STUB() with real implementation #if 0 L358-386 so *mem_info never memset never populated. Registered as .get_local_mem_info callback amdgpu_amdkfd_gfx_v8.c:133 and gfx_v9.c:172. Compare get_cu_info L416 calls memset unconditionally safe. KFD caller passing on-stack uninitialized kfd_local_mem_info + copyout -> leak 24 bytes kernel stack. LATENT: CONFIG_HSA_AMD undefined KFD module absent kfd2kgd callback table never installed. Fix: unconditional memset outside #if 0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1901 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 408 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:354: stubbed get_local_mem_info returns uninitialized output struct
Verified recommended fix
Source-confirmed at sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:354: stubbed get_local_mem_info returns uninitialized output struct
Verdict
Source-confirmed at sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:354: stubbed get_local_mem_info returns uninitialized output struct
No comments yet.