DF-4359 — cik_sdma_init_microcode() swallows amdgpu_ucode_validate() failure for all but the last SDMA instance

File: sys/dev/drm/amd/amdgpu/cik_sdma.c (pass 2) Severity: Low · Confidence: certain · Bucket: base:drm/amdgpu (adjacent to DF-1553 — DISTINCT defect, see below)

What (static proof, no runtime needed)

sys/dev/drm/amd/amdgpu/cik_sdma.c:133  for (i = 0; i < adev->sdma.num_instances; i++) {
sys/dev/drm/amd/amdgpu/cik_sdma.c:138      err = request_firmware(&adev->sdma.instance[i].fw, fw_name, adev->dev);
sys/dev/drm/amd/amdgpu/cik_sdma.c:139      if (err)
sys/dev/drm/amd/amdgpu/cik_sdma.c:140          goto out;                       /* request_firmware IS checked */
sys/dev/drm/amd/amdgpu/cik_sdma.c:141      err = amdgpu_ucode_validate(adev->sdma.instance[i].fw);
                                            /* <-- result NEVER branched on inside the loop */
sys/dev/drm/amd/amdgpu/cik_sdma.c:142  }
sys/dev/drm/amd/amdgpu/cik_sdma.c:143  out:
sys/dev/drm/amd/amdgpu/cik_sdma.c:144      if (err) { ... release all ... }

num_instances == 2 (set in cik_sdma_early_init, cik_sdma.c:950). If instance 0's firmware blob fails validation (err = -EINVAL) but instance 1's passes (err = 0), the loop exits with err == 0: cik_sdma_sw_init() returns success and the unvalidated instance-0 firmware stays in adev->sdma.instance[0].fw.

amdgpu_ucode_validate() (sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251-260) is the only sanity gate on the blob:

if (fw->datasize == le32_to_cpu(hdr->size_bytes))
        return 0;
return -EINVAL;

So a corrupt/inconsistent instance-0 blob (header size_bytes != datasize) — the very class validate exists to reject — is accepted. Its garbage header is then consumed by cik_sdma_load_microcode() (cik_sdma.c:552-565: fw_size = ucode_size_bytes/4, fw_data = fw->data + ucode_array_offset_bytes, 64 KB of WREG32(..., le32_to_cpup(fw_data++))) and amdgpu_ucode_print_sdma_hdr() — i.e. the exact DF-1553 sink is reachable through a door that DF-1553's own fix does not close.

Why distinct from DF-1553

DF-1553 = load_microcode trusts header offset/size fields (missing bounds check in the consumer). DF-4359 = init_microcode drops the error of the validation producer, so a firmware image that fails even the existing weak check is admitted. Different function, different line, different fix (error propagation, not bounds math). Both must be fixed.

Threat model

Firmware files (amdgpufw_<asic>_sdma{,1}) come from the root-owned firmware path; the attacker must already control firmware content (root or supply-chain). Impact ceiling: out-of-bounds kernel read streamed into GPU registers / dmesg via the DF-1553 sink. Same trust model that graded DF-1553/DF-1673 Low.

Fix

--- a/sys/dev/drm/amd/amdgpu/cik_sdma.c
+++ b/sys/dev/drm/amd/amdgpu/cik_sdma.c
@@ -138,6 +138,8 @@ static int cik_sdma_init_microcode(struct amdgpu_device *adev)
        err = request_firmware(&adev->sdma.instance[i].fw, fw_name, adev->dev);
        if (err)
            goto out;
        err = amdgpu_ucode_validate(adev->sdma.instance[i].fw);
+       if (err)
+           goto out;
    }
 out:

Verification status

untested — requires a CIK AMD GPU (Bonaire/Hawaii/Kaveri/Kabini/Mullins) to exercise the amdgpu cik_sdma IP block; the audit guest (DragonFly 6.5-DEVELOPMENT x86_64 under QEMU/KVM) has no AMD PCI device (pciconf -l shows none) so the code path cannot execute at runtime there. Static proof above is line-accurate and complete.

VERDICT — DF-4359

status: untested (runtime PoC impossible on the audit guest — hardware-gated) · impact (demonstrated): none · confidence: certain (static proof).

Reproduced?

No — and it cannot be on this guest: exercising the path requires a CIK AMD ASIC (Bonaire/Hawaii/Kaveri/Kabini/Mullins) so the amdgpu cik_sdma IP block instantiates. Guest check (2026-09-19): pciconf -l on DragonFly 6.5-DEVELOPMENT x86_64 (QEMU/KVM) shows no AMD (0x1002) PCI device; cik_sdma_init_microcode is unreachable at runtime. No kernel build/test was performed; this is a pure code-correctness defect proven from source:

• cik_sdma.c:141 — err = amdgpu_ucode_validate(...) result is never branched on inside the loop; only the last iteration's result reaches the out: handler.
• With num_instances == 2 (cik_sdma.c:950): instance-0 validate failure (-EINVAL) is overwritten by instance-1 success (0) → function returns 0 keeping an unvalidated blob in adev->sdma.instance[0].fw.
• amdgpu_ucode.c:251-260 — validate is the only gate (datasize == hdr->size_bytes); a blob failing it is exactly one whose header is internally inconsistent.
• Downstream sink (already known as DF-1553): cik_sdma.c:552-565 consumes ucode_size_bytes / ucode_array_offset_bytes with no bounds check → OOB kernel read streamed into GPU registers via WREG32 loop; amdgpu_ucode_print_sdma_hdr formats the garbage header.

DF-4359 is DISTINCT from DF-1553: different function (init vs load), different root cause (dropped error propagation vs missing bounds math), different fix. Fixing DF-1553 alone leaves DF-4359 admitting firmware that even the weak check rejects.

Exploit chain

Not applicable: firmware placement requires root (same trust model that graded DF-1553/DF-1673 Low). Ceiling: OOB kernel-memory read into GPU registers / dmesg.

Fix validation

not_testable — no CIK hardware on the guest to build/boot a patched kernel against. The one-line fix (branch on err immediately after cik_sdma.c:141) is mechanically identical to the request_firmware check two lines above; regression risk ~zero.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)