DF-4154 — amdgpu_atombios_init_mc_reg_table: zero-stride block walk never terminates; unbounded walk + unvalidated offsets read past the VBIOS buffer (amdgpu twin of DF-3741)

File: sys/dev/drm/amd/amdgpu/amdgpu_atombios.c (pass 2)

Reproduced?

No — hardware-gated (no AMD GPU on the audit guest; see env.txt). Established at source level.

Source trace (amdgpu_atombios_init_mc_reg_table, lines 1583-1672)

Called from the DPM init paths (si/kv/ci) with a module_index; parses VRAM_Info v2_1:

1. Unvalidated derefs: reg_block = (u8*)vram_info + usMemClkPatchTblOffset (:1607-1609) and reg_data = reg_block + 4 + usRegIndexTblSize (:1610-1613) — both u16 BIOS values used as pointer offsets from a table whose extent is never validated (DF-4104 enabler) → OOB reads before the loop even starts. num_entries is (correctly) clamped to VBIOS_MC_REGISTER_ARRAY_SIZE (32) at :1617-1618, and the destination arrays (mc_reg_address[32], mc_reg_table_entry[20]) are respected — the write side is fine; it is the walk that is unbounded.

2. Zero-stride infinite loop (:1631-1653):

while ((le32_to_cpu(*(u32 *)reg_data) != END_OF_REG_DATA_BLOCK) &&
       (num_ranges < VBIOS_MAX_AC_TIMING_ENTRIES)) {
        t_mem_id = (*(u32 *)reg_data & MEM_ID_MASK) >> MEM_ID_SHIFT;
        if (module_index == t_mem_id) { ...; num_ranges++; }
        reg_data += le16_to_cpu(reg_block->usRegDataBlkSize);   /* may be 0 */
}

The only exits are reading END_OF_REG_DATA_BLOCK (0xFFFFFFFF) or num_ranges == 20. num_ranges increments only when the block's mem id matches. Crafted usRegDataBlkSize == 0 + first dword != 0xFFFFFFFF + t_mem_id != module_index ⇒ the loop spins forever on the same word → kernel hang at DPM init (uninterruptible, IRQ-context-free but boot-path/ bind-path wedge). Identical shape to radeon's radeon_atom_init_mc_reg_table in DF-3741.

3. Unbounded OOB read walk: with a small non-zero stride and no END marker inside the buffer, reg_data marches past the kmalloced BIOS image reading *(u32*)reg_data each step (and the inner :1639-1648 loop reads ((u32*)reg_data + j) for j < reg_table->last, ≤ 32 extra words per block) until it happens to hit 0xFFFFFFFF in adjacent heap or faults. Values land in reg_table->mc_reg_table_entry[] and are later programmed into MC registers.

Verdict

INCONCLUSIVE (hardware-gated / not reachable on the audit guest). Source-certain: (a) deterministic infinite loop on usRegDataBlkSize == 0, (b) unbounded OOB reads of the kernel heap past the BIOS allocation, from a crafted VBIOS at driver bind/DPM init. Severity Medium (DoS + OOB read, hardware-gated).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.