DF-4189 — VERDICT

Status: REPRODUCED (logic-level harness; kernel-level repro hardware-gated) Impact: deterministic kernel page-fault panic on DPM state change (plus garbage-driven clock/voltage programming when the read happens to be mapped) Confidence: certain

Root cause

sumo_parse_pplib_clock_info() sets ps->num_levels = index + 1 — but it is only called from inside the j < ucNumDPMLevels loop (sumo_dpm.c:1508-1520). A pplib power state whose ATOM_PPLIB_STATE_V2.ucNumDPMLevels == 0 (pptable.h:428, u8 from the VBIOS, never validated) leaves the kzalloc'd struct sumo_ps with num_levels == 0. Only BOOT-classified states get patched up (sumo_patch_boot_state, :1395-1403, forces 1); every other state keeps 0.

struct sumo_ps (sumo_dpm.h:44-49) begins with struct sumo_pl levels[SUMO_MAX_HARDWARE_POWERLEVELS] (24-byte elements), and num_levels is u32. Every consumer that asks for the "last" level executes

ps->levels[ps->num_levels - 1]        /* == levels[0xFFFFFFFF] */

= base + 0xFFFFFFFF × 24 ≈ +96 GB past the allocation:

• sumo_set_uvd_clock_before_set_eng_clock — sumo_dpm.c:847-848
• sumo_set_uvd_clock_after_set_eng_clock — sumo_dpm.c:865-866
• sumo_program_bsp — sumo_dpm.c:350 (feeds sumo_calculate_bsp, whose 65535*100/high_clk is the known DF-1438 div0 sink when the garbage is 0)
• sumo_program_at — sumo_dpm.c:426-427 (r[num_levels-1]/l[num_levels-1], stack OOB below u32 r[5]/l[5])
• sumo_dpm_get_sclk — sumo_dpm.c:1891 (sysfs/debugfs sclk read path)
• sumo_program_bsp's write loop for (i = 0; i < ps->num_levels - 1; i++) (:357) underflows to 2^32 iterations → MMIO write storm (hardware hang) if the load itself somehow returned.

Trigger / threat model

Crafted VBIOS with one BOOT state plus one non-BOOT state carrying ucNumDPMLevels == 0, on a Sumo/Ontario/Palm APU. radeon_dpm_pick_power_state selects the crafted state for any matching UI/thermal class; the first radeon_dpm_change_power_state_locked() (display change, thermal event, profile switch — regular operation) reaches sumo_dpm_pre_set_power_state → sumo_update_requested_ps (working copy keeps num_levels == 0) → sumo_dpm_set_power_state → the wild read → page-fault panic. This is the sumo twin of DF-4145 (trinity) / DF-3954 (kv) / DF-3888 (amdgpu kv).

Harness proof (mode 4189)

Two-state crafted table (state 0: ucNumDPMLevels=0, PERFORMANCE, vclk≠boot to force the UVD comparison; state 1: BOOT, 1 level — parse succeeds, boot_ps valid). After sumo_update_requested_ps + sumo_update_current_ps (the sumo_dpm_pre_set_power_state replica), the first sumo_set_uvd_clock_before_set_eng_clock call faults:

expected fault address for levels[num_levels-1].sclk ~= 0x20004e2128 (object + ~95 GB)
*** SIGNAL 11 at address 0x20004b5258 ***

0x20004b5258 − 0xFFFFFFFF×24 = 0x8004b5270 = &pi->requested_ps — i.e. the fault is exactly &pi->requested_ps.levels[0xFFFFFFFF].sclk, the working-copy object the kernel uses at the same call site. An unmapped-address read is deterministic: in the kernel this is a page-fault panic, not a recoverable garbage read.

(The harness faults at the uvd_before site because the load there feeds the observable sumo_setup_uvd_clocks stub; in the kernel all six sites are live. The earlier variant that "survived" uvd_before and faulted inside sumo_program_bsp instead showed the same address — both are the same levels[0xFFFFFFFF] load.)

Fix validation

1. harness_fixed 4189 (-DFIX_DF4189: reject the table when a state parsed zero levels): "power state 0 has no DPM levels", parse returns -22, no crash, canary_violations = 0, exit 0.
2. fix.diff applied with the other three sumo fixes on guest /usr/src (radeon_fix_apply.log hunk 5): radeon.ko builds under -Werror, MAKE_RC=0 (radeon_module_build.log).

Kernel references

• sys/dev/drm/radeon/sumo_dpm.c:1508-1520 (loop that can leave num_levels 0)
• sys/dev/drm/radeon/sumo_dpm.c:1447 (num_levels set only per parsed level)
• sys/dev/drm/radeon/sumo_dpm.c:847-848, :865-866, :350, :426-427, :1891 (the levels[num_levels-1] consumers)
• sys/dev/drm/radeon/sumo_dpm.h:44-49 (levels[] is the FIRST member; u32)
• sys/dev/drm/radeon/pptable.h:424-436 (ucNumDPMLevels from VBIOS, unchecked)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.