Inverted loop condition in psp_v10_0_compare_sram_data bypasses SRAM integrity check
Summary
psp_v10_0_compare_sram_data L435 while(!ucode_size) should be while(ucode_size). Normal case ucode_size>0: !ucode_size=false loop body NEVER executes function unconditionally returns true SRAM-vs-firmware integrity verification silently disabled on Raven/Raven2/Picasso. Sibling psp_v3_1.c:555 and psp_v11_0.c:500 both correctly use while(ucode_size). Degenerate ucode_size==0 case (craftable firmware ucode_size_bytes=0 passes validate): loop runs once derefs *ucode_mem uninitialized heap then ucode_size-=4 underflows UINT_MAX-3 !ucode_size false exits true. LATENT: amdgpu_psp_check_fw_loading_status amdgpu_psp.c:547 inside #if 0 so function never called today. Fix: while(ucode_size).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1956 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 404 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 714 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1956 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: psp_v10_0_compare_sram_data L435 while(!ucode_size) should be while(ucode_size). Normal case ucode_size>0: !ucode_size=false loop body NEVER executes function unconditionally returns true SRAM-vs-firm
Citation: sys/dev/drm/amd/amdgpu/psp_v10_0.c:433-443
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: while(!ucode_size) inverted — SRAM verification never runs (psp_v10_0.c:433-443)
Verified recommended fix
Source-confirmed: while(!ucode_size) inverted — SRAM verification never runs (psp_v10_0.c:433-443)
Verdict
Source-confirmed: while(!ucode_size) inverted — SRAM verification never runs (psp_v10_0.c:433-443)
No comments yet.