Signed table_id comparison allows OOB array index in vega10_copy_table_from_smc / _to_smc
Summary
vega10_copy_table_from_smc (line 37) and _to_smc (line 64) declare table_id as int16_t but are fed uint16_t from vega10_smc_table_manager (line 336 -> 341/343). uint16_t >= 0x8000 narrows to negative int16_t bypassing signed "table_id < MAX_SMU_TABLE(=5)" guard at lines 41/68 (negative promotes to int < 5 == true). Then indexes priv->smu_tables.entry[table_id] with negative index OOB reading memory BEFORE the entry[5] array (vega10_smumgr.h:38). struct smu_table_entry has void *table + uint32_t size at known offsets -> _from_smc OOB-reads entry[neg].table/.size and memcpy into caller buffer (info-leak/kernel-memory disclosure); _to_smc OOB-reads destination pointer+length and memcpy attacker bytes there (corruption/panic). Identical pattern to DF-2021 (vega12_smumgr.c). All in-tree callers (vega10_hwmgr.c:2410/2606/3629/4370, vega10_thermal.c:551) pass compile-time constants (PPTABLE/WMTABLE/AVFSFUSETABLE enum [0,4]) so NOT currently triggerable from userspace -- no sysfs/ioctl/debugfs forwards user table_id. If future code path routes user/firmware selector, _from_smc discloses arbitrary kernel heap (C:H), _to_smc corrupts (I:H/A:H). AV:L/AC:H/PR:L. Fix: int16_t -> uint32_t widening so unsigned < 5 rejects all [5,65535].
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2034 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source-confirmation verdict for DF-2034 | 629 B | ↓ raw |
| fix.diff | suggested-fix | Widen table_id from int16_t to uint32_t to prevent signed OOB | 396 B | view raw |
| ../fix_build.log | build-log | Batch kernel build log (all fixes, rc=0) | 5.6 MB | ↓ download |
DF-2034 Verification Verdict
Severity: Low Impact class: oob Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)
Verdict: REPRODUCED (source-confirmed)
The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.
Fix: Widen table_id from int16_t to uint32_t to prevent signed OOB
Fix applied and validated in batch kernel build (rc=0, -Werror).
Fix validation
All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build.
Build result: rc=0, 0 errors (full -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): vega10_copy_table_from_smc/_to_smc declare table_id as int16_t but are fed uint16_t from vega10_smc_table_manager; uint16_t>=0x8000 narrows to negative int16_t bypassing boun
Verified recommended fix
REPRODUCED (source-only): vega10_copy_table_from_smc/_to_smc declare table_id as int16_t but are fed uint16_t from vega10_smc_table_manager; uint16_t>=0x8000 narrows to negative int16_t bypassing bounds check.
Verdict
REPRODUCED (source-only): vega10_copy_table_from_smc/_to_smc declare table_id as int16_t but are fed uint16_t from vega10_smc_table_manager; uint16_t>=0x8000 narrows to negative int16_t bypassing bounds check.
No comments yet.