DF-4004 — fiji clock-stretcher walk overflows Sclk_voltageOffset[8] with the raw VBIOS SCLK-dep count

File: sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1706-1719 (DDT read walk :1792-1810) Class: kernel heap OOB write (memcorrupt) — DF-1272 (tonga Sclk_voltageOffset[8]) sibling Severity: Medium · Confidence: certain (source) · runtime hardware-gated

Build / Run / Expected

Same demonstrator as DF-4001 (./build.sh && ./run.sh, section === DF-4004 ===):

dep_sclk->count=12 (RAW count, not the dedup'd dpm count): writes at [8..11] are OOB
array sits at DpmTable+1576 of 1632B ... count 255 writes 247B past the array, off the end of smc_state_table

Source chain

fiji_populate_clock_stretcher_data_table walks for (i = 0; i < sclk_table->count; i++) where sclk_table = table_info->vdd_dep_on_sclk (the RAW VBIOS dep table, count = ucNumEntries ≤ 255 — not even the dedup'd dpm count) and writes smc_state_table.Sclk_voltageOffset[i] (:1718) — a fixed uint8_t[8] at DpmTable+1576 (smu73_discrete.h:361) followed only by ClockStretcherDataTable/CKS_LOOKUPTable (struct tail): count > ~24 runs past the whole smc_state_table into the remainder of the fiji_smumgr allocation (ulv_setting/power_tune_table) and beyond. The second walk (:1792) reads GraphicsLevel[j] for j < GraphicsDpmLevelCount (also unclamped, OOB read).

Gating: PHM_PlatformCaps_ClockStretcher is set for PP_TABLE_V1 parts when feature_mask & PP_CLOCK_STRETCH_MASK && usClockStretchAmount != 0 (smu7_hwmgr.c:1664-1668); the walk executes BEFORE the stretch_amount range check at :1731, so even a "rejected" VBIOS amount smears the table first.

Fix

fix.diff (shared): clamp both walks (i < 8 / j < SMU73_MAX_LEVELS_GRAPHICS). Compile-validated via nativekernel rebuild (fix_build.log).

VERDICT — DF-4004

Status: inconclusive at runtime (hardware-gated); source-certain.

Demonstrated (run.log, section DF-4004): with raw vdd_dep_on_sclk->count = 12 the walk at fiji_smumgr.c:1706-1719 writes Sclk_voltageOffset[8..11] — the array is uint8_t[8] at DpmTable+1576 of 1632 (smu73_discrete.h:361), the struct tail. Count 255 writes 247 B past the array, off the end of smc_state_table into the remainder of the fiji_smumgr allocation and past it. Distinct from DF-4001: this walk uses the RAW dependency-table count (table_info->vdd_dep_on_sclk), not the dedup'd dpm count, so even a VBIOS whose dedup collapses below 8 still overflows. The DDT walk :1792-1795 additionally OOB-reads GraphicsLevel[j].

Gating (PP_TABLE_V1 + feature_mask + usClockStretchAmount != 0, smu7_hwmgr.c:1664-1668) is satisfiable by the crafted vBIOS itself, and the walk precedes the stretch_amount range check at :1731.

DF-1272 (tonga Sclk_voltageOffset[8]) sibling; Medium because of the cap gate and the 1-byte-per-entry write granularity. Hardware-gated (env.txt).

Fix: fix.diff clamps both walks; nativekernel rebuild OK (fix_build.log), reverted.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.