DF-4190 — VERDICT

Status: REPRODUCED (logic-level harness; kernel-level repro hardware-gated) Impact: kernel heap OOB read (crash when far out; silent kernel-heap disclosure into power-state fields when the neighbouring pages are mapped) Confidence: certain

Root cause

sumo_parse_power_table() (sys/dev/drm/radeon/sumo_dpm.c:1455-1528) trusts three u8 indices from the VBIOS PowerPlayInfo image without any bounds check:

non_clock_array_index = power_state->v2.nonClockInfoIndex;          /* :1495 u8 0..255 */
non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
        &non_clock_info_array->nonClockInfo[non_clock_array_index]; /* :1496-1497 OOB */
...
        for (j = 0; j < power_state->v2.ucNumDPMLevels; j++) {
                clock_array_index = idx[j];                          /* :1509 u8 */
                ...
                clock_info = (union pplib_clock_info *)
                        ((u8 *)&clock_info_array->clockInfo[0] +
                         (clock_array_index * clock_info_array->ucEntrySize)); /* :1513-1515 OOB */

• nonClockInfo[idx] strides 24 bytes (sizeof(ATOM_PPLIB_NONCLOCK_INFO), pptable.h:298-309): idx 255 reads up to ~6.1 KB past the array.
• clockInfo[idx] strides ucEntrySize — itself a u8 from the image (up to 255), so a single index reaches up to ~65 KB past the clock array.
• the state walk itself (power_state_offset += 2 + ucNumDPMLevels, :1524) advances by up to 257 bytes per state with no end-of-image bound, and idx[j] (:1509) reads past the state entry whenever ucNumDPMLevels exceeds the real array.

The arrays live inside atom_context->bios, a kmalloc'd copy of the GPU ROM image; the reads run past the end of that heap allocation. Values fetched OOB flow into rps->class/class2/caps/vclk/dclk (:1412-1418) — which drive control flow (BOOT/UVD/THERMAL classification → which ps becomes boot_ps, thermal-state patching) and hardware programming (radeon_set_uvd_clocks). With a far index the read hits an unmapped page and panics; with a near index it silently copies adjacent kernel-heap bytes into state fields (kernleak class, same scoping as the DF-1401/1306/1140 twins).

Trigger / threat model

Crafted VBIOS ROM on a Sumo/Ontario/Palm APU (flashed card, replaced OPROM, VM GPU ROM passthrough). Parse happens at driver load; no privilege needed beyond the attacker controlling the ROM.

Harness proof (mode 4190)

16 KB crafted BIOS image, NonClockInfoArray placed near its end, state with nonClockInfoIndex = 250:

bios image: 16384 bytes; nonClockInfo[250] lands at bios+21874 (5490 bytes PAST the end)
*** SIGNAL 11 at address 0x8004c55b2 ***   == the predicted OOB address

The fault address equals the computed &nonClockInfo[250] exactly — the verbatim kernel index math dereferenced past the image buffer. (In the kernel the same read at the same relative offset faults identically or, when the adjacent heap is mapped, silently ingests neighbour bytes.)

Fix validation

1. harness_fixed 4190 (-DFIX_DF4190: reject nonClockInfoIndex >= ucNumEntries): "invalid nonClockInfoIndex 250", parse returns -22, exit 0, no OOB.
2. fix.diff (both nonClockInfoIndex and clockInfoIndex bounds checks, with clean teardown) applied with the other three sumo fixes on guest /usr/src (radeon_fix_apply.log hunks 4 & 5): radeon.ko builds under -Werror, MAKE_RC=0.

Kernel references

• sys/dev/drm/radeon/sumo_dpm.c:1495-1497 (nonClockInfoIndex, unchecked)
• sys/dev/drm/radeon/sumo_dpm.c:1509, :1513-1515 (clockInfoIndex × ucEntrySize, unchecked)
• sys/dev/drm/radeon/sumo_dpm.c:1524 (unbounded state-array walk)
• sys/dev/drm/radeon/sumo_dpm.c:1412-1418 (OOB bytes ingested into rps fields)
• sys/dev/drm/radeon/pptable.h:298-309, :424-464 (u8 indices / entry sizes)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.