DF-4003 — fiji_populate_cac_table overflows BapmVddcVid{Lo,Hi}Sidd[16] and reads vddc_voltage_table.entries[32] OOB

File: sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:772-779 Class: kernel heap OOB write + OOB read (memcorrupt/kernleak) Severity: Medium · Confidence: certain (source) · runtime hardware-gated

Build / Run / Expected

Same demonstrator as DF-4001 (./build.sh && ./run.sh, section === DF-4003 ===):

vddc_lookup_count=40: 24 OOB writes past BapmVddcVidLoSidd[16] (and same for HiSidd), 8 OOB reads of vddc_voltage_table.entries[32]

Source chain

table_info->vddc_lookup_table->count = VBIOS ucNumEntries verbatim (process_pptables_v1_0.c:176 — the lookup buffer itself is only allocated for 16 records, DF-1574 pass 1). fiji_populate_cac_table (:756-782) then loops for (count = 0; count < lookup_table->count; count++) and - writes table->BapmVddcVidLoSidd[count] and BapmVddcVidHiSidd[count] (arrays [SMU73_MAX_LEVELS_VDDC=16], smu73_discrete.h:228-230) → 239 B past each at count 255, clobbering HiSidd2/level-counts/... inside smc_state_table, and past the DpmTable end for large counts; - READS data->vddc_voltage_table.entries[count].value (:774) — a fixed entries[PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES=32] array inside struct smu7_hwmgr (ppatomctrl.h:45,207) → 223 entries past at count 255 (OOB read consumed by phm_get_voltage_index, i.e. smu_helper.c:385-403).

Gated on voltage_control != SMU7_VOLTAGE_CONTROL_NONE (fiji_init_smc_table:1936-1937) — the normal case on SVI2 boards.

Fix

fix.diff (shared): clamp the walk to SMU73_MAX_LEVELS_VDDC and modulo the entries[32] read. Compile-validated via nativekernel rebuild (fix_build.log).

VERDICT — DF-4003

Status: inconclusive at runtime (hardware-gated); source-certain.

Demonstrated (run.log, section DF-4003): with vddc_lookup_table->count = 40 (VBIOS ucNumEntries; the 16-record alloc itself is DF-1574's pass-1 finding), the loop at fiji_smumgr.c:772-779 writes 24 bytes past BapmVddcVidLoSidd[16] and the same past BapmVddcVidHiSidd[16] (arrays at smu73_discrete.h:228-230, SMU73_MAX_LEVELS_VDDC=16), and performs 8 OOB reads of the fixed vddc_voltage_table.entries[32] (:774, ppatomctrl.h:45). At count 255: 239 B past each array (clobbering the level-count fields / GraphicsLevel region of smc_state_table) and 223 reads past entries[32] inside struct smu7_hwmgr.

Reached from fiji_init_smc_table:1936-1937 whenever voltage_control != NONE (the SVI2 default). Hardware-gated like the other fiji findings (env.txt).

Fix: fix.diff clamps the walk to SMU73_MAX_LEVELS_VDDC and bounds the entries[] read; nativekernel rebuild OK (fix_build.log), reverted.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.