DF-4247 — Missing central bounds-validation layer for VBIOS PowerPlay table parsing (processpptables.c)

Status

REPRODUCED (verbatim-rig evidence class, same as DF-4165). All defect families claimed by the finding were demonstrated in byte-identical production parser code compiled into a guest-side harness and driven with crafted PowerPlay tables; the pack's fix.diff was A/B-validated in the same rig (fixed). In-kernel execution remains AMD-ASIC-gated on this guest (no AMD GPU — proven, env.txt/hw_probe.log).

What was verified and how

The rig (rig/) sed-extracts the entire parser body — processpptables.c lines 37-1706, every offset/count/index site — plus 22 verbatim struct/type header slices (pptable.h 26-751, power_state.h, hwmgr/hardwaremanager slices, atombios FW-info tables, processpptables.h interface), and compiles them into a harness on the DragonFly guest.

• rig/check_verbatim.sh re-proved all 23 blocks byte-identical, run on the guest against /usr/src/sys — the tree its running kernel (Jul 2 2026 build) was compiled from (build.log: ALL VERBATIM CHECKS PASSED; host/guest file SHA256 equality in env.txt).
• The fixed build is the same slice with this pack's fix.diff applied via patch --fuzz=0 (bidirectionally proven: forward-apply + reverse-apply restores the pristine file byte-exactly).
• Shims (rig/rig_shims.h) touch no defect path: identity le*_to_cpu, calloc kzalloc, minimized struct pp_hwmgr with production names/types for every field the fix consults, and a smu_atom_get_data_table shim standing in for the ROM FirmwareInfo lookup (NULL-able, to prove DF-1471's missing NULL check). The crafted images mimic ATOM PowerPlay tables a crafted VBIOS (or root-written pp_table sysfs blob) feeds the driver on smu7/smu8 (PP_TABLE_V0); each image ends at a PROT_NONE guard page or at a patterned victim region, making OOB source reads decisive.

Observed (run.log / run.2.log / run.3.log — stable across 3 runs)

Layout: PT=37/46/66/88 bytes, usVddcDependencyOnSCLKOffset@54, usExtendendedHeaderOffset@44, dep record=5B, NONCLOCK=24B, VCE/UVD info=6B.

fix_validation.log = the full FIXED half of the decisive run.

Primitive and impact

Source-side OOB read family: firmware offsets (u16), counts (u8) and indices (u8) index straight out of the soft_pp_table heap image (typically 2-4 KB) — up to 65280 bytes past it — with the read bytes flowing 1:1 into hwmgr->dyn_state.* tables (leak-canary: 70/70 byte-exact), which userland reads back through powerplay sysfs/pp_dpm_* (kernel-heap info leak), plus a NULL-deref panic path when the ROM lacks FirmwareInfo. Write sinks are not in this file (dest allocations over-reserve: 8+12n ≥ 4+8n — layout mode). Gating: an AMD ASIC (smu7/smu8/smu10-shortcircuited) whose VBIOS carries a crafted/corrupt PowerPlay table, or root re-parsing via /sys/class/drm/card0/device/pp_table (amd_powerplay.c:672-706). No unprivileged trigger on stock hardware.

Build / run (on the audit guest, or any DF box with the kernel tree)

scp -r rig fix.diff root@guest:/root/df4247/
cd /root/df4247/rig && sh ./build.sh /usr/src   # verbatim checks + 2 binaries
sh ./run.sh                                      # baseline vs fixed, 13 modes

fix.diff corrections found during verification (this run)

The pre-verification fix.diff did not compile: (1) get_clock_voltage_limit guard referenced table->numEntries — the struct member is ucNumEntries (pptable.h:531); (2) two func(...) calls passed an integer as the const void *clock_info argument (int-conversion). Both corrected in this pack's fix.diff; the corrected diff applies cleanly (fuzz=0) and is what the rig validated.

DF-4247 VERDICT (verify run, 2026-10-14)

Status: REPRODUCED (verbatim-rig evidence class). All defect families the finding enumerates were demonstrated in byte-identical production code; in-kernel execution is AMD-ASIC-gated on this guest (no AMD GPU — proven, env.txt / hw_probe.log). Fix A/B-validated in the same rig: fixed.

1. Method

The guest cannot attach amdgpu (Bochs SVGA 0x1234:1111, no 1002: device, /boot/kernel/amdgpu.ko unloadable — env.txt). Following the DF-4165 evidence class for crafted-firmware parsers, the actual production parser was compiled into a guest-side harness:

• rig/gen_rig.sh extracts processpptables.c:37-1706 — the entire parser body (all get_*_offset/size helpers, all copy helpers, pp_tables_get_num_of_entries/get_entry, the VCE-state getters, pp_tables_initialize, the pptable_funcs vtable) plus 22 header slices (pptable.h 26-751 = every ATOM_PPLIB struct; processpptables.h 28-49; power_state.h 26-187; hwmgr.h 88-186/335-345/347-362/364-373/375-409/ 454-465/485-493/595-624; hardwaremanager.h 55-252/254-258/283-300/326-333/ 344-370; atombios.h 207-214/2941-2945/3055-3131; atom-types.h; amd_asic_type.h; kgd_pp_interface.h 29-39; the PP_ASSERT_WITH_CODE macro).
• rig/check_verbatim.sh re-verified all 23 blocks byte-identical — run on the guest against /usr/src/sys, the tree its running kernel was compiled from (build.log: ALL VERBATIM CHECKS PASSED; SHA256 equality of the three key files host↔guest in env.txt).
• The fixed build is the same slice + exactly this pack's fix.diff (applied to a copy of the pristine full file with patch --fuzz=0; proven bidirectionally: forward apply succeeds with no rejects, reverse apply restores the pristine file byte-exactly).
• Harness shims (rig_shims.h) touch no defect path: identity le16_to_cpu/ le32_to_cpu (LE host, like the target), calloc-backed kzalloc/kfree, a minimized struct pp_hwmgr carrying production names/types for every field the parser and the fix consult (soft_pp_table, soft_pp_table_size exactly as hwmgr.h:718-719), and a smu_atom_get_data_table shim that returns the harness FirmwareInfo blob (or NULL, to exercise the DF-1471 missing-NULL-check). The only live caller of that shim in the slice is init_overdrive_limits (processpptables.c:1062-1064).

Crafted tables mimic real ATOM PowerPlay tables: POWERPLAYTABLE5 header (usTableSize gates the PT3/PT4/PT5 branches at :155/:1300/:1434), extended header for VCE/UVD/SAMU/ACP/PowerTune offsets, StateArray/ClockInfoArray/ NonClockInfoArray for the state paths. Images end exactly at a PROT_NONE guard page (making the first OOB source read fault at a computable offset) or at a 256-byte patterned victim region (leak mode, no guard so the parse completes and the captured bytes can be compared).

2. Observed (run.log; identical in run.2.log / run.3.log)

Exact layouts from the verbatim structs: PT=37, PT3=46, PT4=66, PT5=88; usVddcDependencyOnSCLKOffset@54; usExtendendedHeaderOffset@44; dep record=5 B, table hdr=6 B; ATOM_PPLIB_NONCLOCK_INFO=24; VCE/UVD ClockInfo=6.

Baseline — production code faults on every crafted input (10/10), each at exactly the predicted offset; classified by the SIGSEGV handler:

Leak leg (leak-canary): ucNumEntries=40 with only 5 records in image, image followed by patterned victim bytes: the parse completes and 70/70 field values (clk+v of entries[5..39]) are byte-exact with the victim bytes at the exact OOB source positions — kernel-heap data past soft_pp_table flows 1:1 into hwmgr->dyn_state.vddc_dependency_on_sclk, which userland reads back via powerplay sysfs (pp_dpm_sclk / OD tables). Stable across 3 runs.

Regression control (clean-valid): a fully valid table parses identically in both builds (rc=0, count=3, one clock-info callback).

3. Fix validation (A/B, identical crafted inputs)

rig_fixed = same verbatim slice + this pack's fix.diff (checker-proven identity, bidirectional patch proof). All 10 fault modes: no fault — oversized offsets skipped (rc=0), counts clamped to entries-that-fit (255→3, 40→5), off-by-one indices rejected (>= guards, rc=-1), indices clamped/bounds-checked (rc=-EINVAL / entry 0), fw_info NULL-checked (rc=0); leak-canary: 0 out-of-image values; clean-valid: identical behavior.

Baseline corrupts, patched slice is clean on the same input → fix validated (fix_validation.log). A rebuilt-kernel validation was not performed: the fix sites execute in-kernel only on AMD ASICs absent from this guest; per the verbatim-rig protocol the fixed slice was A/B-validated in the same rig. fix.diff is authored against the pristine read-only sys/ tree and was never applied there.

fix.diff corrections (found by this verification — the pre-verification draft did not compile): 1. get_clock_voltage_limit empty-table guard used table->numEntries; the member is ucNumEntries (pptable.h:531). Fixed. 2. Two func(...) calls in pp_tables_get_entry passed an integer as the const void *clock_info argument (int-conversion; error on modern compilers). Cast added. Fixed. Both corrections are in this pack's fix.diff and are what the rig validated.

4. Primitive and impact

Primitive: attacker-directed source OOB reads out of the kernel-heap PowerPlay image — u16 offsets reach +65535, u8 count loops read linearly past the image (fully value- and length-controlled: every count byte and every index byte is firmware-chosen), u8 indices × u8 entry sizes reach +65025 — with the leaked bytes converted 1:1 into dyn_state clock/voltage tables exposed to userland (kernel-heap info leak, proven byte-exact), plus a NULL-deref kernel panic when the ROM lacks a FirmwareInfo table. Write sinks are NOT in this file (destination allocations over-reserve, 8+12n ≥ 4+8n, layout mode) — the downstream fixed-array overflows (DF-1166, DF-4000..4006, DF-4036..4041, DF-1416/1609) remain separate sink-side fixes, as the finding's coverage assessment states.

Threat model (the family's established one): crafted/corrupted GPU VBIOS (flashed ROM, vfio-pci romfile override, malicious discrete device) parsed at driver attach, or root re-parsing a crafted blob through /sys/class/drm/card0/device/pp_table → pp_dpm_set_pp_table → amd_powerplay_reset → pptable_init (amd_powerplay.c:672-706). No unprivileged userland trigger on stock hardware. Demonstrated out-of-kernel context (rig); impact recorded as leak (the proven, realistic ceiling of this file's defects — info leak + oops-capable NULL deref), not panic (the guest kernel never executed the path).

5. Honest limitations

• Demonstrated with production instructions and production struct layouts, but in a userland mapping, not the kernel's kmalloc heap. The leak leg proves the source bytes are captured; the slab neighborhood contents in kernel context are the allocator's, not a controlled victim.
• The off-by-one modes (entry-v2/v1) require a caller passing entry_index == ucNumEntries; the stock caller loop (pp_tables_get_num_of_entries → 0..N-1) stays in range, so those two are latent wrong-guard defects (defense-in-depth), demonstrated by direct call.
• clockinfo-index-255's fault lands in the clock-info callback (harness mimics the smu7/smu8 deref); the pointer computation itself is verbatim.
• The crafted images are synthetic minimal tables; a real crafted ROM must also satisfy earlier ATOM ROM parsing stages, which precede and do not constrain these fields.
• Cross-file lead unchanged (out of scope for this file): pp_dpm_set_pp_table memcpy heap overflow at amd_powerplay.c:684-689.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.