• File: sys/dev/drm/radeon/radeon_fb.c
• Lines: 271–274 (DragonFly block); consumer at sys/dev/syscons/sckmsrndr.c:476,496,528,579,669 and sys/dev/syscons/syscons.c:4091-4097
• Severity: Info
• CVSS 3.1: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• CWE: CWE-197 Integer Truncation Error
• Confidence: likely
• Status: new

Summary

On the DragonFly path, radeon_fb.c:271-274 stores sizes->fb_width (u32), sizes->fb_height (u32), fb->pitches[0] (u32), and sizes->surface_bpp (u32) into fb_info fields that are uint16_t (struct fb_info at platform/pc64/include/framebuffer.h:53-55).

For pitch ≥ 65536 the stride wraps; the syscons mmap handler at syscons.c:4091-4097 computes its bound as roundup(height*stride, PAGE_SIZE) and then tests ap->a_offset > sz - PAGE_SIZE. If height*stride < PAGE_SIZE (e.g. stride wrapped to 0), sz becomes 0 and sz - PAGE_SIZE underflows size_t to SIZE_MAX, allowing arbitrary-offset mmap of vtophys(vaddr + offset) — kernel-memory read primitive.

Root cause

radeon_fb.c:273 info->stride = fb->pitches[0]; narrows u32 → uint16_t (struct fb_info.stride is uint16_t per platform/pc64/include/framebuffer.h:55).

For a pitch of 65536 (width ≥ 16384 @ cpp=4), stride becomes 0.

syscons.c:4091 computes size_t sz = roundup(scp->sc->fbi->height * scp->sc->fbi->stride, PAGE_SIZE); (both operands uint16_t, product fits in int); for stride=0, sz=0.

syscons.c:4092 if (ap->a_offset > sz - PAGE_SIZE) underflows size_t to SIZE_MAX, always-false → bound check defeated.

syscons.c:4097 then computes ap->a_result = atop(vtophys(scp->sc->fbi->vaddr + ap->a_offset)); for attacker-supplied a_offset, returning the physical page for arbitrary KVA near the framebuffer mapping.

Threat model

Local user with read access to /dev/fb* (typically world-readable on the console) can mmap arbitrary offsets and read physical/kernel memory adjacent to the radeon framebuffer aperture.

The trigger requires fb->pitches[0] ≥ 65536, which in turn requires a display mode with width ≥ 16384 at 32bpp (or ≥ 32768 at 16bpp). No radeon GPU family supports CRTC pipe widths that large (max is typically 8192 on Evergreen/Northern Islands, lower on older families), so the trigger is not reachable on real radeon hardware.

The API contract is nonetheless broken and any future GPU with wider CRTCs (or any other fb_info provider that feeds pitch ≥ 65536) inherits the bug. Flagging as defense-in-depth.

Proof of concept

Theoretical on radeon. To demonstrate on a system that does support ≥ 16384-wide scanout (e.g., a newer amdgpu using the same syscons.c:4091 logic), force an fb with pitch multiple of 65536 via a custom EDID, then from userspace:

int fd = open("/dev/fb0", O_RDWR);
void *p = mmap(NULL, PAGE_SIZE, PROT_READ, MAP_SHARED, fd,
               0x10000000 /* arbitrary */);
printf("%02x", ((unsigned char *)p)[0]);

— succeeds for offsets well past the actual framebuffer, returning kernel memory.

Recommended fix

Either widen fb_info.{width,height,stride} to u32 (cross-cutting change in platform/pc64/include/framebuffer.h:53-55 plus all consumers), or add an explicit guard in radeon_fb.c to refuse pitches that don't fit:

--- a/sys/dev/drm/radeon/radeon_fb.c
+++ b/sys/dev/drm/radeon/radeon_fb.c
@@ -270,6 +270,11 @@
    info->par = rfbdev;
 #ifdef __DragonFly__
+   if (fb->pitches[0] > UINT16_MAX ||
+       sizes->fb_width > UINT16_MAX || sizes->fb_height > UINT16_MAX) {
+       ret = -EINVAL;
+       goto out;
+   }
    info->width = sizes->fb_width;
    info->height = sizes->fb_height;
    info->stride = fb->pitches[0];

A separate hardening fix belongs in syscons.c:4091-4092 to guard against sz == 0: if (sz == 0 || ap->a_offset > sz - PAGE_SIZE) return EINVAL; — but that is out of scope for this file.

References

• sys/dev/drm/radeon/radeon_fb.c:271-274 — the truncating assignments
• sys/platform/pc64/include/framebuffer.h:53-55 — fb_info field widths
• sys/dev/syscons/syscons.c:4091-4097 — underflow + unchecked mmap offset
• sys/dev/syscons/sckmsrndr.c:476,496,528,579,669 — stride consumers