DF-3600 — sq_edc_source_names[] indexed by unbounded 3-bit HW field (OOB rodata read -> %s)

What

gfx_v8_0_parse_sq_irq() reads the EDC source from hardware:

    gfx_v8_0.c:6811
    sq_edc_source = REG_GET_FIELD(RREG32(mmSQ_EDC_INFO), SQ_EDC_INFO, SOURCE);

SQ_EDC_INFO__SOURCE_MASK = 0x1c0 (3-bit field, sys/dev/drm/amd/include/asic_reg/gca/gfx_8_0_sh_mask.h:14083) → values 0..7, but the lookup table has only 7 entries:

    gfx_v8_0.c:710-718
    static const char * const sq_edc_source_names[] = {
        "SQ_EDC_INFO_SOURCE_INVALID", ... "SQ_EDC_INFO_SOURCE_TA",   /* 7 entries */
    };

and the printf at :6831 does sq_edc_source_names[sq_edc_source] with no bound check. When the field reads 7 (reserved encoding — real on parts where the EDC source latches garbage, e.g. uncorrected-but-unmapped EDC events), index 7 reads one pointer past the array in kernel rodata and %s walks it:

• if the adjacent qword is not a valid string pointer → kernel page fault from the log formatter while handling an SQ interrupt (panic from what is supposed to be an error-reporting path), or
• if it happens to be a valid pointer, it prints unrelated kernel rodata to dmesg (minor info disclosure of static kernel content).

Path: gfx_v8_0_sq_irq :6848-6867 → gfx_v8_0_parse_sq_irq :6769 (both ISR and work-queue contexts; in_task() only gates whether the SQ_EDC_INFO register is read — in ISR context sq_edc_source stays -1 and is safe; the unbounded index is the work-queue/task path).

Trigger / severity

Requires the GPU to raise an SQ interrupt with EDC/ECC encoding whose SQ_EDC_INFO.SOURCE latches 7 — a hardware error-event path (not directly commandable by unprivileged GPU users), so: Low, defense-in-depth with a panic side effect.

Reproduce

Source assertion (guest is virtio-only, no AMD HW):

./run.sh

prints the 7-entry array, the 3-bit mask, and the unbounded index site.

Fix

fix.diff: bound the index with ARRAY_SIZE(sq_edc_source_names).

DF-3600 — VERDICT

status: inconclusive (kernel run) / source certain reproduced: 0

Proof

• sq_edc_source_names[] (gfx_v8_0.c:710-718) has exactly 7 elements (INVALID, INST, SGPR, VGPR, LDS, GDS, TA).
• SQ_EDC_INFO__SOURCE_MASK = 0x1c0, __SHIFT = 0x6 (gfx_8_0_sh_mask.h:14083-14084) → a 3-bit field, representable range 0..7. Encoding 7 is reserved/invalid on the hardware side.
• gfx_v8_0_parse_sq_irq :6811 stores the field via REG_GET_FIELD, and the DRM_INFO at :6831 evaluates (sq_edc_source != -1) ? sq_edc_source_names[sq_edc_source] : "unavailable". The only guard is != -1 (the ISR-context sentinel); nothing bounds the value to the array. Source == 7 → sq_edc_source_names[7] reads the rodata qword after the array and hands it to %s:
• invalid pointer → fault inside the printk/%s formatter while servicing an SQ interrupt (kernel panic in the error handler), or

• valid pointer → adjacent kernel rodata printed to dmesg (minor static- content disclosure).

• Trigger: SQ interrupt with enc 1/2 processed in task context (gfx_v8_0_sq_irq :6848-6867 → work func :6839-6846) while SQ_EDC_INFO.SOURCE latches the reserved encoding 7 — a hardware EDC event path, not directly controllable by unprivileged GPU users. Severity Low (robustness of an error-reporting path).

Why not a kernel run

Audit guest is virtio-only (no AMD GPU, no drm/amdgpu module, /boot/modules absent). inconclusive at runtime; index/mask mismatch proven from source (run.log).

Fix validation

fix.diff bounds the index with ARRAY_SIZE(sq_edc_source_names). Not buildable on this guest — fix_status: not_testable; diff line-matched to gfx_v8_0.c:6831.

kernel_refs

• sys/dev/drm/amd/amdgpu/gfx_v8_0.c:710-718 (7-entry array)
• sys/dev/drm/amd/amdgpu/gfx_v8_0.c:6811 (3-bit field read)
• sys/dev/drm/amd/amdgpu/gfx_v8_0.c:6831 (unbounded index + %s)
• sys/dev/drm/amd/include/asic_reg/gca/gfx_8_0_sh_mask.h:14083 (mask 0x1c0)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.