DF-4238 — sdma_v3_0: SDMA firmware sub-header fields read after only

datasize==size_bytes validation — heap OOB read on a short (root-installed) firmware blob (DF-1451/1553/1598 family, v3 variant)

What

sdma_v3_0_init_microcode() (sys/dev/drm/amd/amdgpu/sdma_v3_0.c) validates each SDMA firmware image only through amdgpu_ucode_validate(), which checks a single equality — fw->datasize == hdr->size_bytes (amdgpu_ucode.c:251-260) — and then immediately reads SDMA sub-header fields that live beyond the common header:

• sdma_v3_0.c:316 hdr->header.ucode_version (common header +16)
• sdma_v3_0.c:317 hdr->ucode_feature_version (sdma v1_0 header +32; struct sdma_firmware_header_v1_0 is 48 bytes — amdgpu_ucode.h:120-126)
• sdma_v3_0.c:324-326 header->ucode_size_bytes (common header +24) folded into adev->firmware.fw_size, which sizes the firmware BO later memcpy'd from fw->data + ucode_array_offset_bytes (amdgpu_ucode.c:347-351, the DF-1947 sink).

A blob as small as 4 bytes (declaring size_bytes = 4) passes validation; every field read above is then a heap out-of-bounds read on the request_firmware buffer.

Threat model

Firmware files (amdgpufw_tonga_sdma etc., sdma_v3_0.c:54-68) are root- installed module firmware — same gate as DF-1451 (sdma_v4_0), DF-1553 (cik_sdma), DF-1598 (sdma_v2_4). Low severity: root-triggerable kernel heap OOB read (leak into fw_version/feature_version printed to dmesg, and fw_size inflation feeding the DF-1947 memcpy sink).

Evidence in this pack

• fwcheck.c — harness replicating the exact validate-then-read sequence on a 4-byte blob placed against a guard page. Built and run on the audit guest (DragonFly cc 8.3): 1. amdgpu_ucode_validate(4-byte blob) = 0 (accepted) 2. the first sub-header read (ucode_version at +16, the exact first field sdma_v3_0.c:316 reads) faults into the guard page → SIGSEGV, exit 139 — the out-of-bounds access proven without ASan.
• run.log — full untrimmed guest output.
• fix.diff — minimum-size guard in sdma_v3_0_init_microcode (the shared root fix — offset/size cross-validation in amdgpu_ucode_validate — is DF-1946 and out of scope for this file).

Reproduce

# on the DragonFly guest (no AMD hardware needed for the harness)
cc -O2 -Wall -o fwcheck fwcheck.c
./fwcheck; echo $?     # prints validate=0, then dies SIGSEGV (139) at the +16 read

The kernel path itself is hardware-gated (Tonga/Polaris/Fiji/Carrizo/Stoney SDMA engine — none on the guest, see env.txt), so the finding is not_reproduced / hardware-gated; the parsing primitive is proven by the harness.

DF-4238 VERDICT — sdma_v3_0 firmware sub-header OOB read (DF-1451/1553/1598 family, v3 variant)

Status: not_reproduced (hardware-gated: guest has no AMD GPU; parsing primitive proven by a guest-run harness). Confidence: certain (code). Impact: heap OOB read on root-installed firmware → Low.

1. Root cause (path:line)

• amdgpu_ucode.c:251-260 — amdgpu_ucode_validate() checks ONLY fw->datasize == le32_to_cpu(hdr->size_bytes). No minimum size, no header_size/ucode_size/offset cross-validation (root finding DF-1946).
• sdma_v3_0.c:309-317 — after request_firmware + the equality-only validate, the code casts fw->data to struct sdma_firmware_header_v1_0 (48 bytes; amdgpu_ucode.h:120-126) and reads:
• hdr->header.ucode_version — common header offset 16 (sdma_v3_0.c:316),
• hdr->ucode_feature_version — offset 32 (sdma_v3_0.c:317).
• sdma_v3_0.c:321-326 — header->ucode_size_bytes (offset 24) is folded into adev->firmware.fw_size with no bound vs datasize; the payload is later memcpy'd from fw->data + ucode_array_offset_bytes for ucode_size_bytes bytes into the firmware BO (amdgpu_ucode.c:347-351 — the DF-1947 sink; on VI the load type is AMDGPU_FW_LOAD_SMU, amdgpu_ucode.c:291-300, so the BO path is the live one for Tonga et al.).

A firmware blob of datasize = 4 with size_bytes = 4 passes validation; reads at +16/+24/+32 are heap OOB. The reads at :316/:317 feed dmesg (fw_version/feature_version influence burst_nop at :318-319) — an OOB-read → dmesg leak channel; fw_size at :325-326 is inflated by the OOB value read at +24.

2. Harness verification (guest)

fwcheck.c replicates the sequence against a 4-byte blob placed at the end of a mapped page with a PROT_NONE guard page after it (stand-in for the exact-size request_firmware allocation). Guest run (DragonFly 6.5-DEVELOPMENT, cc 8.3 — run.log):

amdgpu_ucode_validate(4-byte blob) = 0 (0 == accepted)
validate passed: no minimum-size check (DF-1946 root), sdma_v3_0.c proceeds to read sub-header fields
RUN_EXIT=139 139=SIGSEGV          <- fault at the +16 read (ucode_version)
Segmentation fault (core dumped)

The first field read by sdma_v3_0.c:316 is the one that faults — the exact access order of the kernel function.

3. Honest classification

• The guest kernel has /boot/kernel/amdgpu.ko but no AMD PCI device (pciconf -l → zero 0x1002 vendors; virtio-vga only — env.txt), so the kernel path cannot execute → not_reproduced, impact none (nothing demonstrated in-kernel). Same discipline as the family findings DF-1451/DF-1553/DF-1598 and DF-4027.
• Trigger requires replacing an amdgpufw_* firmware file (root) and booting/loading amdgpu on Tonga/Polaris/Fiji/Carrizo/Stoney hardware.
• Severity Low (privileged input; OOB read; fw_size inflation feeding the DF-1947 memcpy sink). CWE-125 / CWE-20.

4. Fix

fix.diff: reject any SDMA firmware whose datasize < sizeof(struct sdma_firmware_header_v1_0) before the sub-header reads (sdma_v3_0.c:312-317). This is the v3 twin of the DF-1598 fix; the shared root fix (full header cross-validation in amdgpu_ucode_validate) is DF-1946's scope, and the memcpy sink hardening is DF-1947's — deliberately not duplicated here.

fix_status: not_testable (no AMD hardware on the guest; the guard is trivially exercised by the harness's accepted-then-rejected sequence).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.