DF-4248 — V1-branch state-array off-by-one (entry_index > ucNumStates)

Where

sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:937 (V1 branch of pp_tables_get_entry, tables with ucTableFormatRevision < 6), twin of the known V2 off-by-one covered by DF-1472 at :913 (this site was not in DF-1472's listed scope).

What

if (entry_index > powerplay_table->ucNumStates)   /* off by one: == passes */
        return -1;
pstate_entry = (ATOM_PPLIB_STATE *)...usStateArrayOffset +
                entry_index * powerplay_table->ucStateEntrySize;

entry_index == ucNumStates walks one ATOM_PPLIB_STATE past the array and then iterates ucStateEntrySize-1 clock indices read from out-of-bounds bytes, feeding garbage ucClockStateIndices[] to the callback. Reads only (sink indices are re-derived), so impact = OOB read of the VBIOS heap image.

Trigger

Same as the VBIOS/pp_table family: crafted PowerPlay table (format rev < 6) on smu7/smu8-class hardware, or root pp_table sysfs swap racing a state enumeration between pp_tables_get_num_of_entries and pp_tables_get_entry (the two calls are separately locked in amd_powerplay.c, so a table swap in between makes entry_index == ucNumStates reachable).

Fix

Included in DF-4247's central fix.diff (> -> >=); minimal hunk:

-       if (entry_index > powerplay_table->ucNumStates)
+       if (entry_index >= powerplay_table->ucNumStates)
            return -1;

Build/run

Hardware-gated (needs an AMD pre-Vega ASIC attached); see env.txt. ./run.sh documents the absence of AMD hardware on the audit guest.

DF-4248 VERDICT

status: untested (hardware-gated: no AMD GPU on the audit guest — run.log) impact: none demonstrated (OOB read, Low) | confidence: certain (code-trace)

Trace

processpptables.c:937 uses > where >= is required, so entry_index == ucNumStates passes the guard; :940-942 then computes the state entry at ucNumEntries * ucStateEntrySize — one entry past the last — and :953-957 loops ucStateEntrySize-1 times reading pstate_entry->ucClockStateIndices[i] from that OOB entry, with each index used to derive a pclock_info pointer handed to the hw callback (:959). Identical defect class to the V2 twin at :913 (DF-1472), but on the ucTableFormatRevision < 6 code path — a distinct site requiring its own hunk, which DF-1472's fix would not touch.

Normally entry_index < num_of_entries (callers iterate pp_tables_get_num_of_entries), so the off-by-one requires a table swap between the two calls (root pp_table write, amd_powerplay.c:672-706) or a malicious VBIOS that reports different counts across reads. Impact ceiling: heap OOB read of the (attacker-supplied) table image — low.

Fix

> -> >= at :937 (and the V2 twin at :913); both contained in DF-4247/fix.diff. fix_status: not_testable (no hardware to build/run a kernel with the fix; the one-line change is compile-trivial).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)