⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-4070

Unclamped VBIOS MCLK DPM count overflows MemoryLevel[4] in vegam_populate_all_memory_levels — count=5 already OOB

Summary

Same class as DF-4069 but a LOWER bar: MemoryLevel capacity is 4 (32B entries). mclk count=5 (any pptable with >=5 MCLK dep entries) writes 32B past the array into LinkLevel[0]; count=255 writes 8,160B - far past the DpmTable and the allocation. The [count-1] store was checked and is not underflowable. Clamp fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4070 · 8 files
FileTypeDescriptionSize
probe.c — 2.5 KB view raw
build.log — 28 B view raw
run.log — 792 B view raw
verdict.json — 2.3 KB view raw
README.md — 441 B ↓ raw
VERDICT.md — 1.5 KB ↓ raw
fix.diff — 767 B view raw
manifest.json — 933 B view raw
README.md
↓ download raw

DF-4070 — vegam MCLK MemoryLevel heap OOB write; count=5 already overflows (pass 2)

File: sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1047-1074

Build (guest probe): cd /tmp && cc -I/usr/src/sys/dev/drm/amd/powerplay/inc -o probe probe.c Run: ./probe Expected: MemoryLevel=32B, capacity 4*32=128B; count=5 -> byte 160 (already OOB); count=255 -> 8160B. Full trigger needs VegaM GPU + crafted VBIOS pptable (absent). Hardware-gated.

VERDICT.md
↓ download raw

DF-4070 VERDICT — source-level certain, hardware-gated

Root cause

  • vegam_populate_all_memory_levels() loops i < dpm_table->mclk_table.count writing levels[i] — vegam_smumgr.c:1047-1062 (and 1069-1071) into MemoryLevel[SMU75_MAX_LEVELS_MEMORY=4] (smu75_discrete.h:289; 32B entries, capacity 128B at offset 748 of the 1956B DpmTable).
  • mclk_table.count = VBIOS u8 ucNumEntries via smu7_hwmgr.c:704-712 / 799-810 — unclamped.
  • LOWER BAR THAN THE SCLK TWIN (DF-4069): any pptable with >= 5 MCLK dep entries overflows (5*32=160 > 128): 32B past the array into LinkLevel[0]. count=255 ⇒ 8,160B ⇒ far past the whole vegam_smumgr allocation.

Negative checked (NOT a bug)

  • levels[dpm_table->mclk_table.count - 1].DisplayWatermark = ... (:1073): count==0 would index 0xFFFFFFFF, but both smu7 setup paths assert dep-mclk count >= 1 and return -EINVAL (smu7_hwmgr.c:704-707 and :793-796) before vegam ever runs. No underflow.
  • MemoryDpmLevelCount = (uint8_t)count (:1064): no truncation (u8-sourced).

Why not reproduced / probe evidence

No VegaM GPU on guest; probe (run.log) proves the exact capacities cited above.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

Hardware-gated finding (no AMD VegaM GPU / no LSI mps controller on the audit guest): fix authored at source level (fix.diff) but not build/boot-validated.

fix.diff in this pack; authored post-analysis, not hardware-validated.
↓ fix.diffper-fix-DF-4070

Confirmed kernel references

Detail

Evidence (decisive lines)

run.log: sizeof(SMU75_Discrete_MemoryLevel)=32, capacity 4*32=128B; count=5 -> byte 160 (OOB); count=255 -> 8160B; smu75_discrete.h:289

PoC changes

n/a (source-level; sizes from guest probe run.log)

Verified recommended fix

Clamp the MCLK level walk and MemoryDpmLevelCount to SMU75_MAX_LEVELS_MEMORY.

Verdict

Source-level certain, hardware-gated. vegam_populate_all_memory_levels() walks dpm_table.mclk_table.count (unclamped VBIOS u8 count) writing levels[i] into MemoryLevel[SMU75_MAX_LEVELS_MEMORY=4] (32B each, 128B capacity, offset 748). count=5 is ALREADY OOB (32B past the array into LinkLevel[0]); count=255 writes 8,160B => far past the 1956B DpmTable and the vegam_smumgr allocation. The bar is lower than the SCLK walk (4 vs 8). The [count-1] store at :1073 was checked and is NOT underflowable: both smu7 setup paths assert dep-mclk count >= 1 and return -EINVAL. Hardware-gated (crafted VBIOS pptable on a VegaM SKU).