smu8_upload_pptable_to_smu NULL-derefs the four optional dependency tables (vdd_gfx/acp/uvd/vce) at driver load
Summary
The dependency-table pointers are conditionally constructed only when each VBIOS extension offset is non-zero, but upload dereferences them unconditionally in the PP_ASSERT guards and the fill loop. A VBIOS omitting any of the four tables panics at powerplay init with a ->count read from NULL. Distinct tables/sites from DF-1419 (vddc case). NULL-check-all-five fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4170 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 1.2 KB | ↓ raw | |
| VERDICT.md | — | 1.2 KB | ↓ raw | |
| verdict.json | — | 2.8 KB | view raw | |
| manifest.json | — | 801 B | view raw | |
| env.txt | — | 847 B | view raw | |
| fix.diff | — | 542 B | view raw |
DF-4170 — smu8_upload_pptable_to_smu NULL-derefs four optional dependency tables
- File: sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:443-474
- Class: NULL pointer dereference at driver load, CWE-476. Hardware-gated (KV/CZ APU, VBIOS powerplay table omitting an optional extension table).
- Distinct tables/sites from DF-1419 (which covers vddc_dependency_on_sclk in smu8_construct_max_power_limits_table :259-265).
Chain
- processpptables.c:1210-1230 NULL-initializes vce/uvd/samu/acp/vdd_gfx dependency tables; each is built ONLY if its extension offset in the VBIOS powerplay table is non-zero (e.g. :1231-1239 for VCE, :1244+ for UVD, acp/vdd_gfx similar).
- smu8_upload_pptable_to_smu takes pointers to vddc/vdd_gfx/acp/uvd/vce tables (:443-452) and immediately dereferences ->count in the PP_ASSERT_WITH_CODE guards (:465-474) and in the level-fill loop (:476-547) with NO NULL checks.
- VBIOS omitting e.g. the ACP limit table => acp_table->count at :469 reads address 0 => page-0 fault => panic during amdgpu powerplay init (asic_setup).
- (vddc is dereferenced even earlier by DF-1419's site; the four other tables reach their first deref here.)
Build/run: not runnable here (no AMD APU in audit guest, see env.txt).
VERDICT — DF-4170
status: untested (hardware-gated; guest has no AMD GPU — env.txt) expected impact: page-0 dereference panic during amdgpu driver load when the VBIOS powerplay table omits any of the vdd_gfx / acp / uvd / vce extension tables
Root cause
smu8_hwmgr.c:465-474 dereferences five dyn_state dependency-table pointers whose construction is conditional (processpptables.c:1210-1265: each table is only built when the corresponding offset field in the ATOM_PPLIB extension header is non-zero; they are NULL-initialized at :1210-1230). The vddc case was filed as DF-1419 at its own earlier site; these four tables first crash here.
Fix
fix.diff: refuse upload (-EINVAL) when any of the five tables is missing. Authored from source; not build-validated.
Why untested
No AMD hardware in the audit guest (env.txt). Chain is static and complete.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableFix authored from source analysis only: Reject powerplay-table upload (-EINVAL) when any of the five dependency tables is missing. Baseline/patched kernels could not be exercised on the audit guest (no AMD GPU), so fix validation is not_testable rather than fixed.
fix.diff in this pack (unified diff generated against the pristine sys/ tree).
Confirmed kernel references
Detail
Exploit chain
Hardware attacker model only: crafted VBIOS on AMD hardware (flashed ROM / vfio romfile). No userland-triggerable chain on the audit guest - path hardware-gated.
Evidence (decisive lines)
VERDICT.md (root cause, line-accurate), README.md (trigger math), env.txt (guest hardware-gating proof: pciconf/sysctl/uname), fix.diff (source-authored, git-apply-able, not build-validated).
PoC changes
None - no seeded PoC sources existed for these pass-2 findings; packs built fresh.
Verified recommended fix
Reject powerplay-table upload (-EINVAL) when any of the five dependency tables is missing.
Verdict
smu8_upload_pptable_to_smu dereferences vdd_gfx/acp/uvd/vce dependency-table pointers (smu8_hwmgr.c:443-452 -> :465-474 and the fill loop :476-547) that processpptables.c:1210-1265 only constructs when the corresponding VBIOS extension offset is non-zero; each stays NULL otherwise. A VBIOS omitting any of those tables panics the driver at load with a page-0 read of ->count. Distinct tables/sites from DF-1419 (vddc table at :259-265, which crashes first only for the vddc case).
No comments yet.