DF-4002 — Unclamped VBIOS MM-dependency count overflows fiji UvdLevel[8]/VceLevel[8]/AcpLevel[8] SMC arrays

File: sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c Class: kernel heap OOB write (memcorrupt) — DF-1271 (tonga) / DF-1296 (ci) / DF-1346 (polaris10) / DF-1366-67 (vegam) family, fiji variant Severity: High · Confidence: certain (source) · runtime hardware-gated

Build / Run / Expected

Same demonstrator as DF-4001 (./build.sh && ./run.sh, section === DF-4002 ===):

VceLevel[8]:  mm_count=20 -> 12 OOB writes, 144 bytes past
AcpLevel[8]:  mm_count=20 -> 12 OOB writes, 144 bytes past
UvdLevel[8]:  mm_count=20 -> 12 OOB writes, 192 bytes past

Source chain

table_info->mm_dep_table->count = VBIOS ucNumEntries (u8 ≤ 255) verbatim (process_pptables_v1_0.c:698-712); fiji pinned to this parser (hwmgr.c:86/127). Consumers index fixed arrays without any clamp: - fiji_populate_smc_vce_level — table->VceLevelCount = (uint8_t)(mm_table->count) (:1433), walk :1436-1457 writes VceLevel[count] (SMU73_Discrete_ExtClkLevel 12 B × 8, smu73_discrete.h:255) - fiji_populate_smc_acp_level — same shape :1472, walk :1475-1494 into AcpLevel[8] (:256) - fiji_populate_smc_uvd_level — same shape :1569, walk :1572-1601 into UvdLevel[8] (16 B × 8, :254)

Arrays sit at DpmTable offsets ~+864/+960/+1056 of 1632 B inside the fiji_smumgr kzalloc; count 255 writes ~3 KB past, running off the end of the allocation into adjacent heap. Reached unconditionally from fiji_init_smc_table:1976/1980/1992.

Fix

fix.diff (shared with DF-4001 pack): NULL-check + clamp each populate walk to SMU73_MAX_LEVELS_{VCE,ACP,UVD}. Compile-validated via nativekernel rebuild (fix_build.log).

VERDICT — DF-4002

Status: inconclusive at runtime (hardware-gated); source-certain.

Reproduced in the guest demonstrator (run.log, section DF-4002): with mm_dep_table->count = 20 (a single VBIOS byte, max 255), the exact walk shape of fiji_populate_smc_vce_level (fiji_smumgr.c:1436-1457) writes 12 × 12 B past VceLevel[8]; the ACP twin (:1475-1494) 12 × 12 B past AcpLevel[8]; the UVD twin (:1572-1601) 12 × 16 B past UvdLevel[8] — all inside the heap-resident smc_state_table of the fiji_smumgr kzalloc (:339), running off the allocation at count 255 (~3 KB). Count provenance: process_pptables_v1_0.c:698-712 (mm_table->count = mm_dependency_table->ucNumEntries, no clamp anywhere); fiji pinned to this parser at hwmgr.c:86/127. Sinks reached unconditionally from fiji_init_smc_table:1976/1980/1992.

No in-kernel observation possible: guest has no AMD GPU (env.txt). Trigger context = crafted vBIOS / hostile eGPU at driver attach — DF-1271 (tonga) / DF-1296 (ci) / DF-1346 (polaris10) / DF-1366-67 (vegam) family, fiji variant; those siblings were rated High, likewise here.

Fix: fix.diff NULL-checks and clamps each walk to SMU73_MAX_LEVELS_{VCE,ACP,UVD}; applied to guest /usr/src, full nativekernel rebuild OK (fix_build.log), reverted.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.