DF-3908 — Tonga/Fiji SMC ARB timing table: kernel stack OOB write via unclamped VBIOS DPM counts

File: sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c Lines: 1492-1507 (tonga_program_memory_timing_parameters) Severity: High (kernel stack corruption) — hardware-gated (Tonga/Fiji GPU + crafted VBIOS) Class: memcorrupt / CWE-787 (out-of-bounds write), pass 2 (checklist item (a): clock-count-driven stack tables)

Build

./build.sh     # cc -O2 -Wall -o trigger_analysis trigger_analysis.c  (on the DragonFly guest)

Run

./run.sh

Expected output

arb_regs stack object        : 384 bytes (entries[8][4], 12B each)
VBIOS dep counts (sclk,mclk) : 12 x 6
total writes                 : 72
OOB writes past stack object : 26 (first at +384, worst at +588..+599)
=> kernel stack corruption up to 216 bytes past a 384-byte frame
trigger rc=1 (1 == OOB writes demonstrated)

The harness reproduces the exact index arithmetic of the kernel loops; the kernel path itself requires Tonga/Fiji hardware (absent from the QEMU guest — see env.txt), hence the PoC verdict is inconclusive (source-certain, hardware-gated), consistent with DF-1271/DF-1272/DF-1280 precedent.

Root cause

data->dpm_table.sclk_table.count / mclk_table.count are filled by smu7_setup_dpm_tables_v1() (smu7_hwmgr.c:752-830) directly from the VBIOS SCLK/MCLK dependency-table entry counts (u8, ≤255, deduplicated only — the dpm_levels[8] overflow there is DF-1166). No code path clamps them to the SMU72 table sizes before tonga_program_memory_timing_parameters() indexes the stack object SMU72_Discrete_MCArbDramTimingTable arb_regs (entries[SMU__NUM_SCLK_DPM_STATE=8][SMU__NUM_MCLK_DPM_LEVELS=4], 12 bytes/entry = 384 bytes) with for (i...) for (j...) populate(..., &arb_regs.entries[i][j]). With a crafted VBIOS reporting >8 SCLK or >4 MCLK distinct levels, writes run up to ~15 KB past the stack frame with GPU DRAM-timing values derived from VBIOS-controlled clocks (return-address smash potential on machines without stack protector — the kernel is built -fno-stack-protector).

Fix

fix.diff clamps both loop bounds with MIN(count, SMU72_MAX_LEVELS_*). Validated: applied to the guest's clean /usr/src, full make nativekernel KERNCONF=X86_64_GENERIC rebuild → rc=0, -Werror clean (fix_build.log, fix_kernel_full.log line 28191 compiles tonga_smumgr.c).

DF-3908 — Verification Verdict

Status: inconclusive (reproduced=0) Impact: none (no Tonga/Fiji hardware on the guest) Confidence: certain (source-level)

Finding

VBIOS-controlled SCLK/MCLK DPM counts (bounded only by the u8 dependency-table entry count) index the fixed entries[8][4] stack table SMU72_Discrete_MCArbDramTimingTable arb_regs in tonga_program_memory_timing_parameters() without any clamp → kernel stack OOB write at driver init / OD reprogram time.

Source proof chain

1. process_pptables_v1_0.c get_sclk_voltage_dependency_table / get_mclk_voltage_dependency_table allocate the dep tables with count = ucNumEntries (u8 ≤ 255) — count is VBIOS-controlled.
2. smu7_hwmgr.c:752-830 smu7_setup_dpm_tables_v1() copies every distinct clock into dpm_table->sclk_table / mclk_table, incrementing count per accepted entry — never clamped to SMU72_MAX_LEVELS_* (the dpm_levels[8] overflow on the way is already filed as DF-1166).
3. smu7_hwmgr.c:3780-3817 smu7_trim_* only flips enabled, never reduces count.
4. tonga_smumgr.c:2296 calls tonga_program_memory_timing_parameters() from tonga_init_smc_table() (and from the OD path at :2552-2561).
5. tonga_smumgr.c:1492 declares arb_regs (384-byte stack object); :1497-1502 indexes arb_regs.entries[i][j] for i < sclk_table.count, j < mclk_table.count — OOB for i≥8 / j≥4. Max extent: (2554+255)12 ≈ 15.3 KB past a 384-byte frame.
6. Array dims: smu72_discrete.h:156-169 (entries[SMU__NUM_SCLK_DPM_STATE=8][SMU__NUM_MCLK_DPM_LEVELS=4], entry = 2×uint32 + uint8 + pad = 12 B).

Why inconclusive, not reproduced

The path executes only during AMD GPU powerplay init on Tonga/Fiji (chip family AMDGPU_FAMILY_VI, tonga/fiji ASICs). The QEMU guest has no AMD GPU (env.txt: pciconf shows only Intel/QEMU virtual PCI devices). The userspace demonstrator (run.log) reproduces the exact index arithmetic and shows 26 OOB writes for a modest 12×6 crafted VBIOS, but cannot fault a kernel stack that never runs.

Fix validation

fix.diff clamps both loops with MIN(count, SMU72_MAX_LEVELS_*). Applied on the guest's clean /usr/src together with DF-3909/3910/3911/3912; full make -j4 nativekernel KERNCONF=X86_64_GENERIC: tonga_smumgr.c compiled with -Werror (fix_kernel_full.log:28191), error count 0, "Kernel build for X86_64_GENERIC completed", rc=0 (fix_build.log). fix_status = fixed (compile-validated; runtime validation requires hardware).

Prior art

Checklist item (a) — the smu7_hwmgr.c twin (amd_pp_clocks.clock[16] stack copies) is DF-3684; this is the tonga_smumgr.c stack-table sink, not covered by DF-1271..DF-1275.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.