DF-4032 evidence pack

r600_check_texture_resource's mipmap BO bounds check is commented out (r600_cs.c:1603-1606): any LAST_LEVEL/BASE_LEVEL/word3 mip offset is accepted regardless of mipmap BO size. texmip_sim (run.log) s

Build

./build.sh   (cc -O2 -Wall; verified on the DragonFly audit guest — build.log)

Run

./run.sh     (verified on the DragonFly audit guest — run.log; triggers exit 2:
             /dev/dri absent — no radeon GPU on the QEMU guest, see env.txt)

Expected on r600/rv770 hardware

See VERDICT.md.

DF-4032 — r600 texture mipmap BO bounds check is commented out (GPU OOB mip walk)

File: sys/dev/drm/radeon/r600_cs.c Severity: Medium (cross-process GPU memory disclosure via texture sampling; hardware-gated)

Root cause (path:line)

r600_check_texture_resource() computes the mipmap chain size with r600_texture_size() (r600_cs.c:1399-1457) and then... does nothing:

1602:   /* using get ib will give us the offset into the mipmap bo */
1603:   if ((mipmap_size + word3) > radeon_bo_size(mipmap)) {
1604:       /*dev_warn(p->dev, "mipmap bo too small (%d %d %d %d %d %d -> %d have %ld)\n",
1605:         w0, h0, format, blevel, nlevels, word3, mipmap_size, radeon_bo_size(texture));*/
1606:   }
1607:   return 0;

The check body is commented out, so any texture resource is accepted regardless of the mipmap BO size. word3 (the user's mip offset) and mipmap_size (derived from LAST_LEVEL/BASE_LEVEL/width/height/format) are otherwise unbounded (the l0_size check at :1594 covers only level-0 in the texture BO).

The GPU texture unit then walks mip levels past the end of the mipmap BO: sampling the texture in a subsequent draw reads adjacent GPU memory (other processes' BOs / GTT pages), and the sampled values can be rendered into an attacker-owned target — a cross-process info-leak. The PoC geometry (512x512 R8, 10 levels, 256-byte mipmap BO) walks 87,125 bytes past the BO (texmip_sim, run.log).

The size accumulation itself is also u32 (offset += size in r600_texture_size:1450), so even a restored check must be u64-safe — the proposed fix in fix.diff restores it with (u64) casts.

Upstream status

The commented-out check is identical in current Linux master (upstream r600_cs.c:1603-1609 — "don't break userspace" heritage). Unfixed upstream.

Verification (this pack)

• texmip_sim.c — replicates r600_mip_minify/r600_texture_size for the PoC resource and prints the per-level offsets: mipmap_size 87,381 bytes vs a 256-byte mipmap BO (run.log, executed on the guest).
• r600_cs_poc.c mode texmip — SET_RESOURCE VALID_TEXTURE submission with the two relocs (texture BO 1 MiB, mipmap BO 256 B) exactly as the parser expects; builds clean on the guest.
• Runtime hardware-gated (no radeon GPU on the audit guest — env.txt).

Suggested fix

fix.diff: restore the check with 64-bit arithmetic and reject oversized mipmap requirements.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.