DF-4001 — Unclamped VBIOS SCLK/MCLK DPM counts overflow fiji SMC state tables incl. a 384-byte STACK MC-arb table

File: sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c Class: kernel heap + stack OOB write (memcorrupt) — DF-4000 (iceland) / DF-3908/3939/3940 family, fiji variant Severity: High · Confidence: certain (source) · runtime hardware-gated

Build / Run / Expected (on the DragonFly audit guest)

./build.sh     # cc -O2 -Wall -I /usr/src/sys/dev/drm/amd/powerplay/inc -o fiji_walks trigger_analysis.c
./run.sh       # ./fiji_walks

Expected (see run.log): the demonstrator compiles the kernel's own packed headers (smu73.h, smu73_discrete.h) so sizeof/offsets are the kernel's, then reproduces the walks with attacker-chosen VBIOS counts (sclk=12, mclk=6):

DF-4001a ... sclk_count=12: 4 OOB level writes, 176 bytes past GraphicsLevel[8]
DF-4001b ... mclk_count=6 (Fiji SMU73 bound is 4!): 2 OOB writes, 48 bytes past MemoryLevel[4]
DF-4001c ... sclk=12 mclk=6: 26 PAST the 32-entry table (max linear entry 49 of 32)
            deepest write offset 600B into a 384B stack object -> 216 bytes into the caller frame

Why it is real (source chain, attacker = crafted vBIOS / eGPU flash)

1. VBIOS PowerPlay table (v1) ucNumEntries (u8 ≤ 255) is stored verbatim as the dependency-table count: process_pptables_v1_0.c:389 (mclk), :436 (sclk).
2. Fiji is pinned to this parser: hwmgr.c:86 (PP_TABLE_V1 default) + hwmgr.c:127 (CHIP_FIJI → fiji_smu_funcs; only CI/TOPAZ drop to PP_TABLE_V0).
3. smu7_hwmgr.c:783-810 dedups the dep tables into dpm_table.sclk_table.count / mclk_table.count — unclamped against the fixed dpm_levels[8] (DF-1166, pass 1).
4. fiji_populate_all_graphic_levels (fiji_smumgr.c:1026-1036) walks count entries into levels[i] = smc_state_table.GraphicsLevel[SMU73_MAX_LEVELS_GRAPHICS=8] (smu73_discrete.h:249); [count-1] store at :1042; pcieDpmLevel loops :1055-1057, :1080-1081. struct fiji_smumgr is a single kzalloc (fiji_smumgr.c:339) → heap OOB write past the object for count > ~45 (GraphicsLevel sits at DpmTable+236 of 1632B).
5. fiji_populate_all_memory_levels (:1238-1247, [0] fixups :1250/:1257, [count-1] :1265) into MemoryLevel[SMU73_MAX_LEVELS_MEMORY=4] (smu73_discrete.h:251) — count 5 already overflows.
6. fiji_program_memory_timing_parameters (:1533) declares SMU73_Discrete_MCArbDramTimingTable arb_regs; on the stack (384 B, entries[8][4], smu73_discrete.h:154-157) and the nested loops :1537-1546 write entries[i][j] for i<sclk_count, j<mclk_count — with 255/255 the walk runs to 15,300 B past a 384-byte kernel-stack object (return-address direction; write content is VBIOS-derived register values).
7. The clock-stretcher DDT walk additionally READS GraphicsLevel[j] for j<GraphicsDpmLevelCount (:1792-1795) — OOB read of the same count.

Sinks are reached from fiji_init_smc_table (:1964, :1988) during pp_hwmgr init (device attach / resume) — privileged-time execution of attacker-controlled VBIOS bytes (malicious vBIOS flash or hostile eGPU).

Fix

fix.diff clamps every walk to the SMU73 array bounds (and clamps the level counts handed to the SMC); compile-validated by full nativekernel rebuild (see fix_build.log).

VERDICT — DF-4001

Status: inconclusive at runtime (hardware-gated); source-certain.

Reproduced

The index arithmetic and corruption extents are reproduced on the audit guest by trigger_analysis.c (run.log), using the kernel's own packed headers:

Struct geometry measured with the kernel's own headers: sizeof(DpmTable)=1632, GraphicsLevel@+236 (44 B/level), MemoryLevel@+612 (24 B/level), arb entry 12 B, arb table 384 B.

The in-kernel fault could not be observed: the audit guest has no AMD GPU (env.txt: amd-gpu=0, virtio-only), and the trigger requires a Fiji (Fiji XT / R9 Fury) card with a crafted vBIOS — physical attacker / malicious vBIOS / hostile eGPU, same gate as DF-4000 (iceland), DF-3908/3939/3940.

Why the counts are attacker-controlled and unclamped (three-hop provenance)

1. process_pptables_v1_0.c:425-436 get_sclk_voltage_dependency_table and :378-391 get_mclk_voltage_dependency_table set table->count = ucNumEntries (VBIOS byte, ≤ 255); the allocation matches the count, so no clamp exists anywhere.
2. hwmgr.c:86 sets pp_table_version = PP_TABLE_V1 by default; hwmgr.c:127-130 pins CHIP_FIJI to fiji_smu_funcs (only CI/TOPAZ downgrade to PP_TABLE_V0).
3. smu7_hwmgr.c:783-810 (smu7_setup_dpm_tables_v1) copies the dep-table entries (dedup by clk) into dpm_table.sclk_table/mclk_table.count — unclamped vs MAX_REGULAR_DPM_NUMBER(8); the en-route dpm_levels[8] smash is DF-1166 (pass 1, smu7_hwmgr.c). The fiji-side sinks below are this file's: GraphicsLevel[8], MemoryLevel[4], stack entries[8][4], plus the :1792-1795 DDT GraphicsLevel[j] OOB read.

No intervening clamp exists: grep the whole populate path — the only min() on pcie is smu7_hwmgr.c:561 (which is why LinkLevel is safe; see negative notes in the audit result).

Exploitability (why High)

• Heap: count 12 already writes 176 B past GraphicsLevel[8] inside the struct fiji_smumgr allocation, corrupting MemoryACPILevel/MemoryLevel/ LinkLevel/Uvd/Vce/Acp/Samu/Ulv/Smio...; count ≥ ~45 runs past the whole kzalloc into adjacent heap (count 255 → 10.8 KB). Content is VBIOS-influenced (clocks/voltages per level).
• Stack: the arb walk is a linear stack smash up to 15.3 KB past a 384-byte frame object in the return-address direction; DragonFly kernels are built without stack protectors by default. Trigger context = driver attach/resume (privileged), so this is malicious-vBIOS-class, not unprivileged-local.

Fix validation

fix.diff clamps all walks/counts to the SMU73 bounds. Applied to pristine guest /usr/src (md5 800babd0.. → d50bdc81..), full make nativekernel KERNCONF=X86_64_GENERIC rebuild completed (fix_build.log / fix_kernel_full.log), then reverted. Runtime re-test impossible on this guest (no AMD GPU).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.