Truncation of mem->num_pages (unsigned long) to unsigned in VRAM-visible accounting and free paths
Summary
amdgpu_vram_mgr_bo_visible_size (line 112) and amdgpu_vram_mgr_del (line 271) both copy mem->num_pages (unsigned long 64-bit on LP64) into local "unsigned pages" (32-bit). For BO larger than 2^32 pages (~16 TiB) count silently truncated. In _del cleanup loop "while(pages){ pages -= nodes->size; drm_mm_remove_node(nodes); ++nodes; }" operates on narrowed value: once pages underflows loop exits early leaving drm_mm nodes dangling; kvfree(mem->mm_node) frees backing array while drm_mm still references nodes. _new path (line 198 pages_left = mem->num_pages correctly unsigned long) does NOT truncate so huge BO allocated with k nodes but _del only walks truncated remainder. Requires BO with num_pages > UINT_MAX = >16 TiB VRAM; amdgpu_bo_validate_size gates with size < (man->size << PAGE_SHIFT). No shipping GPU (MI300X 192GB ~50M pages) can reach this. Path itself (DRM_IOCTL_AMDGPU_GEM_CREATE VRAM domain amdgpu_gem.c:208) unprivileged but size precondition not satisfiable on real HW. Real divergence from upstream Linux hardening (fixed u64 upstream). AV:L/AC:H/PR:L, A:L.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2040 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source-confirmation verdict for DF-2040 | 637 B | ↓ raw |
| fix.diff | suggested-fix | Widen pages from unsigned to u64 to prevent num_pages truncation | 460 B | view raw |
| ../fix_build.log | build-log | Batch kernel build log (all fixes, rc=0) | 5.6 MB | ↓ download |
DF-2040 Verification Verdict
Severity: Low Impact class: overflow Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)
Verdict: REPRODUCED (source-confirmed)
The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.
Fix: Widen pages from unsigned to u64 to prevent num_pages truncation
Fix applied and validated in batch kernel build (rc=0, -Werror).
Fix validation
All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build.
Build result: rc=0, 0 errors (full -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): amdgpu_vram_mgr_bo_visible_size and amdgpu_vram_mgr_del copy mem->num_pages (unsigned long 64-bit) into local unsigned (32-bit); for BO > 16TiB the count truncates and OOB in
Verified recommended fix
REPRODUCED (source-only): amdgpu_vram_mgr_bo_visible_size and amdgpu_vram_mgr_del copy mem->num_pages (unsigned long 64-bit) into local unsigned (32-bit); for BO > 16TiB the count truncates and OOB indexes page array.
Verdict
REPRODUCED (source-only): amdgpu_vram_mgr_bo_visible_size and amdgpu_vram_mgr_del copy mem->num_pages (unsigned long 64-bit) into local unsigned (32-bit); for BO > 16TiB the count truncates and OOB indexes page array.
No comments yet.