r600_copy_dma under-reserves ring dwords: sync semaphore+fence can overflow reserved count corrupting GPU command stream
Summary
r600_dma.c L459 radeon_ring_lock(rdev,ring,num_loops*4+8). radeon_sync_rings radeon_sync.c:137-201 emits up to RADEON_NUM_SYNCS=4 semaphore_wait 3 dwords each=12 on destination ring. r600_dma_fence_ring_emit L285-298 writes 4 dwords. Worst-case overhead 16 dwords reservation covers only 8 -> deficit 8. radeon_ring_write radeon.h:2710 tests count_dw<=0 DRM_ERROR then unconditionally writes ring->ring[wptr++] ptr_mask wraps overwriting earlier unconsumed commands. GPU ring corruption -> lockup/hang/spurious DMA. ptr_mask prevents kernel-heap OOB. Admin-gated radeon_testing/benchmark tunable required same caveat as DF-1942. evergreen_dma.c:123 same pattern num_loops*5+11 also undersized. Fix: num_loops*4+RADEON_NUM_SYNCS*3+8.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1943 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 486 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 709 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1943 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: r600_dma.c L459 radeon_ring_lock(rdev,ring,num_loops*4+8). radeon_sync_rings radeon_sync.c:137-201 emits up to RADEON_NUM_SYNCS=4 semaphore_wait 3 dwords each=12 on destination ring. r600_dma_fence_ri
Citation: sys/dev/drm/radeon/r600_dma.c:459-483
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: ring_lock under-reserves dwords for sync semaphore (r600_dma.c:459-483)
Verified recommended fix
Source-confirmed: ring_lock under-reserves dwords for sync semaphore (r600_dma.c:459-483)
Verdict
Source-confirmed: ring_lock under-reserves dwords for sync semaphore (r600_dma.c:459-483)
No comments yet.