DF-4289 — SS-assignment walk bounded only by unvalidated VBIOS usStructureSize → OOB read (≤64 KB past ATOM table)

Pass-2 finding for sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c. Distinct from DF-1498 (ASIC_ProfilingInfo leakage arrays): this is the ASIC_InternalSS_Info walk in asic_internal_ss_get_ss_asignment() feeding atomctrl_get_engine_clock_spread_spectrum() / atomctrl_get_memory_clock_spread_spectrum().

The bug (ppatomctrl.c:1231-1243)

ssInfo = &table->asSpreadSpectrum[0];

while (((uint8_t *)ssInfo - (uint8_t *)table) <
        le16_to_cpu(table->sHeader.usStructureSize)) {
        if ((clockSource == ssInfo->ucClockIndication) && ...)
                break;
        ssInfo = (ATOM_ASIC_SS_ASSIGNMENT *)((uint8_t *)ssInfo +
                sizeof(ATOM_ASIC_SS_ASSIGNMENT));
}

• table comes from smu_atom_get_data_table(..., &size, ...) (ppatomctrl.c:1204-1207). The atom layer returns a raw pointer into the BIOS image (bios + data_start) and its size/usStructureSize are VBIOS-controlled; amdgpu_atom_parse_data_header (sys/dev/drm/amd/amdgpu/atom.c:1384-1403) validates nothing.
• The only loop bound is usStructureSize — the table's own header field — never checked against the actual allocated table size. A VBIOS with usStructureSize (USHORT) larger than the real table walks ATOM_ASIC_SS_ASSIGNMENT (10-byte) entries past the end of the BIOS image: up to 65535 bytes past the table base, dereferencing ucClockIndication and ulTargetClockRange each step (OOB read, CWE-125). On x86-64 kernel heap that is adjacent-kernel-memory read until an unmapped page or a coincidental match stops it; the values are then copied into ssEntry (speed_spectrum_percentage, speed_spectrum_rate) and used to program spread-spectrum PLL registers by the callers (ci/iceland/fiji/tonga/vegam smumgr).

Callers (attach-time, chip-specific)

atomctrl_get_engine_clock_spread_spectrum ← ci_smumgr.c:343, iceland_smumgr.c:843; atomctrl_get_memory_clock_spread_spectrum ← ci_smumgr.c:1084, iceland_smumgr.c:~1090 family — all during SMC table construction at driver attach.

Threat model

Crafted VBIOS on an AMD dGPU (same as DF-1498): boot/module-load OOB read of adjacent kernel heap (bounded 64 KB), potential panic on unmapped page, or silent programming of garbage SS parameters.

Reproduce

Not runnable on this guest (no AMD dGPU — env.txt). Trigger shape on hardware: ASIC_InternalSS_Info table whose header usStructureSize exceeds the table's actual size with no entry matching the requested clockSource. Expected: OOB read walk / eventual Fatal trap 12 on unmapped page during attach.

DF-4289 VERDICT — SS-assignment OOB walk

Status: inconclusive (code-trace certain; guest has no AMD dGPU)

Trace

• asic_internal_ss_get_ss_asignment() — ppatomctrl.c:1215-1273.
• :1226-1229 table = asic_internal_ss_get_ss_table(hwmgr->adev); NULL-checked.
• :1204-1207 the table is smu_atom_get_data_table(..., &size, &frev, &crev) — size is fetched but never used anywhere in the function.
• :1231-1243 walk bound is exclusively le16_to_cpu(table->sHeader.usStructureSize) — a field inside the (attacker-supplied) table content, not the atom-layer table size.
• Each iteration reads ssInfo->ucClockIndication (:1235) and ssInfo->ulTargetClockRange (:1236) — reads happen at the current offset before the bound is re-checked, so a usStructureSize larger than the real table immediately reads past it; stride sizeof(ATOM_ASIC_SS_ASSIGNMENT) (fixed), max excursion ≤ 0xFFFF bytes.
• Atom layer (sys/dev/drm/amd/amdgpu/atom.c:1384-1403): amdgpu_atom_parse_data_header() performs no validation of idx, *size, or the bios buffer bounds; smu_atom_get_data_table (smu_helper.c:660-673) passes the raw pointer through.
• Exit conditions: match on (clockSource, clockSpeed ≤ ulTargetClockRange) or bound reached. Non-matching crafted table ⇒ full 64 KB excursion.
• Output ssEntry fields (:1246-1254): speed_spectrum_percentage, speed_spectrum_rate (raw VBIOS USHORT, and for table rev ≥ 2.2/3 divided by the constant 100 at :1253 — see DF-4290 for the div0 that this value feeds), speed_spectrum_mode. These are consumed by ci_smumgr.c:343-356 / :1084-1092 and equivalents in iceland/fiji/tonga/vegam smumgr to program CG_SPLL_SPREAD_SPECTRUM / MPLL_SS registers.

Bound check on the other dimension (verified safe)

The fixed-stride walk starts at offsetof(ATOM_ASIC_INTERNAL_SS_INFO, asSpreadSpectrum[0]) and the bound is checked before each iteration's reads, so for a correct usStructureSize there is no OOB; the defect is solely the unvalidated upper bound. No write occurs (pure read walk + copy-out into the caller's pp_atomctrl_internal_ss_info).

Impact

Boot/module-load OOB read of adjacent kernel heap (CWE-125), panic on unmapped page possible, or programming of garbage PLL/SS register values (hardware-stability impact). Crafted-VBIOS threat model ⇒ Medium, consistent with DF-1498. Not runnable on this guest (no AMD dGPU) ⇒ inconclusive status, trace-certain.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.