DF-4346 — amdgpu atom_index_iio: unvalidated VBIOS opcode indexes 10-entry atom_iio_len[] (kernel .data OOB) and drives an unbounded walk past the BIOS image

sys/dev/drm/amd/amdgpu/atom.c:1291 — base += atom_iio_len[CU8(base)] with an opcode byte straight from the VBIOS (0..255) into the 10-entry static atom_iio_len[] (atom.c:1280). Out-of-range opcodes read past the array in kernel .data; the resulting stride walks the IIO table past the bios allocation at driver attach. Amdgpu twin of DF-4338 (radeon), previously unfiled for this file.

Reproduce (logic level — guest has no AMD GPU)

cc -O1 -g -o atom_harness atom_harness.c
./atom_harness iio          # opcode 200 -> atom_iio_len[200] -> SIGSEGV/139
./atom_harness_fixed iio    # op > ATOM_IIO_END -> clean stop, exit 0

See run.log case iio and fix_run.log. Kernel-runtime validation requires an AMD card with crafted VBIOS (not emulatable in QEMU).

Fix

fix.diff — bound the opcode before indexing (return on op > ATOM_IIO_END); full bios_size-bounded walk in the DF-4345 port.

DF-4346 VERDICT — atom_index_iio OOB opcode index + unbounded walk (amdgpu twin of DF-4338)

Status: inconclusive (kernel runtime hardware-gated; logic-level OOB reproduced on the audit guest). Defect: certain.

Root cause

atom_index_iio (atom.c:1280-1294), byte-identical to the radeon twin DF-4338 fixed:

1287: while (CU8(base) == ATOM_IIO_START) {
1288:         ctx->iio[CU8(base + 1)] = base + 2;
1289:         base += 2;
1290:         while (CU8(base) != ATOM_IIO_END)
1291:                 base += atom_iio_len[CU8(base)];
1292:         base += 3;
1293: }

• atom_iio_len (atom.c:1280) has 10 entries (ATOM_IIO_NOP..ATOM_IIO_END = 0..9). The opcode byte CU8(base) is unvalidated VBIOS data (0..255): atom_iio_len[CU8(base)] reads up to 990 bytes past the static array in kernel .data (info leak into the walk, garbage stride).
• The garbage (or a crafted in-range) stride then drives base forward with no bound — the walk reads past the bios allocation at attach until it happens to hit ATOM_IIO_END or faults.

Runs at driver attach via amdgpu_atom_parse (atom.c:1334) on the IIO pointer taken from the master data table.

Reproduction

Guest (no AMD GPU): ./atom_harness iio — verbatim loop, atom_iio_len placed at a guard page. Opcode byte 200 → atom_iio_len[200] → SIGSEGV exit=139 (run.log, case iio). Fixed logic (./atom_harness_fixed iio) rejects op > ATOM_IIO_END and bounds the walk → exit 0 (fix_run.log).

Fix

fix.diff — the standalone opcode-bound fix (same shape as DF-4338's): validate the opcode against ATOM_IIO_END before indexing, and stop the walk. The complete bound (walk also limited by bios_size) is included in the central DF-4345 port.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.