DF-1942

Integer overflow in r600_copy_dma size_in_dw: silent short/zero-length GPU copy with successful fence (latent on R600, live on rv770/evergreen siblings)

Summary

r600_dma.c L451 size_in_dw/cur_size_in_dw declared u32. L457 size_in_dw=(num_gpu_pages<<RADEON_GPU_PAGE_SHIFT)/4 shift 12 in 32-bit unsigned wraps for num_gpu_pages>=0x100000 (>=4GiB buffer) -> size_in_dw=0 -> num_loops=0 -> for-loop never executes -> no DMA packets but L483 fence_emit signals success. Caller ttm_bo_move_accel_cleanup believes copy complete re-points BO metadata destination has stale data. REACHABILITY CAVEAT: on R600/RV610/RV630 r600_copy_dma is .dma not .copy (r600_copy_cpdma is .copy). Only reached via radeon_test/benchmark boot tunable default 0. Latent in-tree; same pattern rv770_dma.c:57/evergreen_dma.c:121 IS user-reachable (.copy path). Fix: u64 intermediate reject num_gpu_pages>U32_MAX>>12.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — drivers
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:N/I:H/A:N
CWE: CWE-190
File: sys/dev/drm/radeon/r600_dma.c
Lines: 457-490
Area: dev
Discovered: 2026-07-20
Updated: 2026-07-20

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: panic
Confidence: certain
Tested: 2026-07-23 17:00:17
Attempts: —
Runtime: —
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-07-23 17:00:17
Runtime: —
Kernel: combined build rc=0
fix.diff: findings/poc/DF-1942/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-1942 · 4 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited bug	441 B	view raw
VERDICT.md	verdict	source-confirmation analysis	1.0 KB	↓ raw
build.sh	build-script	N/A (source-only)	65 B	view raw
run.sh	run-script	N/A (source-only)	89 B	view raw

VERDICT.md verdict source-confirmation analysis

↓ download raw

DF-1942 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: r600_dma.c L451 size_in_dw/cur_size_in_dw declared u32. L457 size_in_dw=(num_gpu_pages<=0x100000 (>=4GiB buffer) -> size_i

Citation: sys/dev/drm/radeon/r600_dma.c:457-490

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: (num_gpu_pages<<12)/4 overflow yields 0-size silent DMA (r600_dma.c:457)

Verified recommended fix

Source-confirmed: (num_gpu_pages<<12)/4 overflow yields 0-size silent DMA (r600_dma.c:457)

Verdict

Source-confirmed: (num_gpu_pages<<12)/4 overflow yields 0-size silent DMA (r600_dma.c:457)