polaris10 clock-stretcher walk overflows Sclk_voltageOffset[8] using the raw VBIOS SCLK-dependency count; AVFS walk OOB-reads entries[i<NUM_VFT_COLUMNS] when the count is lower
Summary
fiji DF-4004 family + polaris-unique under-read: populate_clock_stretcher walks i < RAW vdd_dep_on_sclk->count writing Sclk_voltageOffset[8] (walk runs BEFORE the stretch_amount validation so a 'rejected' VBIOS smears first); populate_avfs_parameters walks i<NUM_VFT_COLUMNS=8 reading entries[i] regardless of count - count<8 reads past the allocation, values uploaded to SMU. Guest-demonstrated. Clamp + bound fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4038 · 12 files| File | Type | Description | Size | |
|---|---|---|---|---|
| polaris_walks.c | — | 19.5 KB | view raw | |
| build.sh | — | 65 B | view raw | |
| run.sh | — | 89 B | view raw | |
| build.log | — | 0 B | ↓ download | |
| run.log | — | 4.8 KB | view raw | |
| env.txt | — | 533 B | view raw | |
| fix.diff | — | 1.5 KB | view raw | |
| fix_build.log | — | 1.2 KB | view raw | |
| README.md | — | 1.1 KB | ↓ raw | |
| VERDICT.md | — | 2.7 KB | ↓ raw | |
| manifest.json | — | 1.2 KB | view raw | |
| verdict.json | — | 4.0 KB | view raw |
DF-4038 — polaris10 clock-stretcher walk overflows Sclk_voltageOffset[8] using the raw VBIOS SCLK-dependency count; AVFS walk OOB-reads entries[i<8] when the count is lower
File: sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c
Severity: Medium | Class: CWE-787 Out-of-bounds Write (with CWE-125 read)
Status: hardware-gated — source-certain; runtime reproduction impossible on the audit guest
(no Polaris GPU / no AMD53C974 HBA — see env.txt). Verdict: inconclusive, confidence certain.
Build & run (on the DragonFly guest)
./build.sh # compiles the demonstrator (uses the guest's kernel headers) ./run.sh # reproduces the exact index arithmetic / branch selection
Expected: the DF-4038 section of run.log shows the OOB offsets / panic-branch selection / fault.
Full guest details in env.txt.
Fix validation
fix.diff applied (with all DF-4036..DF-4044 patches together) to a clean guest /usr/src copy;
make nativekernel KERNCONF=X86_64_GENERIC completed with 0 errors under -Werror
(see fix_build.log — polaris10_smumgr.o recompiled).
Sources restored to pristine afterwards (md5-verified).
DF-4038 VERDICT — polaris10 clock-stretcher walk overflows Sclk_voltageOffset[8] using the raw VBIOS SCLK-dependency count; AVFS walk OOB-reads entries[i<8] when the count is lower
Bottom line
Source-certain heap OOB write + read over table_info->vdd_dep_on_sclk (the RAW VBIOS dependency table, allocated with exactly count entries — hwmgr_ppt.h entries[1] flex): polaris10_populate_clock_stretcher_data_table walks i < sclk_table->count (polaris10_smumgr.c:1555) writing Sclk_voltageOffset[8] (:1574) — count>8 smears DpmTable+1704 (of 1884) past the array into ClockStretcherDataTable/CKS_LOOKUPTable and off smc_state_table; the walk runs BEFORE the stretch_amount validation at :1579 so even a rejected VBIOS value smears first; cks_enable<=8 (value only). The mirror bug in polaris10_populate_avfs_parameters (:1688-1691) walks i < NUM_VFT_COLUMNS=8 reading sclk_table->entries[i] regardless of count — a VBIOS with fewer than 8 SCLK dep entries reads past the heap allocation and the values are uploaded to SMU (:1697-1710). Demonstrated: run.log DF-4038a/b. fiji DF-4004 sibling. Hardware-gated -> runtime inconclusive, source certain.
Exploit chain
crafted vBIOS: (a) vdd_dep_on_sclk->count > 8 -> Sclk_voltageOffset[8] OOB byte writes; (b) count < 8 -> AVFS walk reads entries past the allocation, values go to SMU
Why not reproduced on the guest
The audit guest is QEMU/KVM with virtio display only: no AMD GPU, /dev/dri absent (env.txt), so polaris10_powerplay never binds — the crafted-VBIOS trigger cannot be exercised at runtime. The index arithmetic and struct geometry are proven against the kernel headers compiled verbatim (run.log), and the fix is compile-validated (fix_build.log).
Negative results recorded alongside (pass-2 depth)
Checklist item kills: LinkLevel i<=count walk is bounded (pcie count clamped to <=7 at smu7_hwmgr.c:561-569); mc_reg-table walks are not in this file (smu7_smumgr.c owns them); fan-table div0 is known DF-1345; VCE/UVD count overflow is known DF-1346; Smio[32] and SmioTable.Pattern[4] walks are correctly clamped (SMU_MAX_SMIO_LEVELS).
Fix
Clamp the clock-stretcher walk to NUM_VFT_COLUMNS(8) and bound the AVFS walk by sclk_table->count (fix.diff). Applied and compile-validated on the guest (fix_build.log); sys/ tree never modified by the audit.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
fixedfixed (compile-validated): all nine patches applied together to the clean guest /usr/src copy (polaris10_smumgr.c md5 6f39bb32..->19a2b278.., amd.c f577a330..->54ce1518..), make -j4 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with 0 compile errors under -Werror; the patched polaris10_smumgr.o (amdgpu module) and amd.o (GENERIC kernel) both recompiled. Runtime re-test impossible on this guest (device absent). Sources restored to pristine and md5-verified after validation.
findings/poc/DF-4038/fix.diff; findings/poc/DF-4038/fix_build.log (build banner + compile lines + 0 errors)
Confirmed kernel references
- sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1555
- sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1574
- sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1579
- sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1688
- sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1690
- sys/dev/drm/amd/powerplay/inc/smu74_discrete.h:361
- sys/dev/drm/amd/powerplay/inc/smu74.h:758
Detail
Exploit chain
crafted vBIOS: (a) vdd_dep_on_sclk->count > 8 -> Sclk_voltageOffset[8] OOB byte writes; (b) count < 8 -> AVFS walk reads entries past the allocation, values go to SMU
Evidence (decisive lines)
run.log sections DF-4038a/b; VERDICT.md; fix_build.log; env.txt
PoC changes
Pass-2 reviewer authored demonstrator compiling the kernel's own headers (smu74.h/smu74_discrete.h packed, or a verbatim copy of the driver's amdsentmsg/parsemsg arms) so struct geometry and branch selection are the kernel's; fix.diff generated against the pristine file and compile-validated via full nativekernel rebuild on the guest (shared build with DF-4036..DF-4044, fix_build.log).
Verified recommended fix
Clamp the clock-stretcher walk to NUM_VFT_COLUMNS(8) and bound the AVFS walk by sclk_table->count (fix.diff)
Verdict
Source-certain heap OOB write + read over table_info->vdd_dep_on_sclk (the RAW VBIOS dependency table, allocated with exactly count entries — hwmgr_ppt.h entries[1] flex): polaris10_populate_clock_stretcher_data_table walks i < sclk_table->count (polaris10_smumgr.c:1555) writing Sclk_voltageOffset[8] (:1574) — count>8 smears DpmTable+1704 (of 1884) past the array into ClockStretcherDataTable/CKS_LOOKUPTable and off smc_state_table; the walk runs BEFORE the stretch_amount validation at :1579 so even a rejected VBIOS value smears first; cks_enable<=8 (value only). The mirror bug in polaris10_populate_avfs_parameters (:1688-1691) walks i < NUM_VFT_COLUMNS=8 reading sclk_table->entries[i] regardless of count — a VBIOS with fewer than 8 SCLK dep entries reads past the heap allocation and the values are uploaded to SMU (:1697-1710). Demonstrated: run.log DF-4038a/b. fiji DF-4004 sibling. Hardware-gated -> runtime inconclusive, source certain.
No comments yet.