DF-4366 — amdgpu_set_pp_power_profile_mode: strsep NULL deref panic + unterminated stack walk

File: sys/dev/drm/amd/amdgpu/amdgpu_pm.c:916-975 (the sysfs store for pp_power_profile_mode, i.e. the entry that dispatches into pp_set_power_profile_mode / amd_powerplay.c:888-910) · Severity: Low (root-only sysfs, deterministic kernel panic) · Class: CWE-476 NULL deref (+ CWE-125 uninitialized-stack overread)

Bug (source)

The CUSTOM-profile parse loop:

944:  memcpy(buf_cpy, buf, count-i);          /* buf_cpy[128], NO NUL written */
946:  tmp_str = buf_cpy;
947:  while (tmp_str[0]) {
948:      sub_str = strsep(&tmp_str, delimiter);   /* {' ','\n','\0'} */
949:      ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
...
955:      while (isspace(*tmp_str))           /* tmp_str == NULL after the
956:          tmp_str++;                          last un-delimited token */

DragonFly strsep (sys/libkern/strsep.c:63-65) sets *stringp = NULL when it consumes the remainder without finding a delimiter. A write that does not end in ' '/'\n' — e.g. printf '5 1 2 3' > /sys/class/drm/card0/device/pp_power_profile_mode (no echo-added newline) — copies count-i bytes ending exactly on the sysfs NUL sentinel, the final token's strsep matches the '\0' delimiter, returns tmp_str = NULL, and the very next isspace(*tmp_str) (sys/sys/ctype.h:43 expands to a comparison on *tmp_str) dereferences NULL → Fatal trap 12, fault address 0x0.

Secondary: buf_cpy[128] is never NUL-terminated by the code (termination falls out accidentally from the off-by-one copy that includes the sysfs sentinel); any input shape where i == 0 (no space after the leading profile digit) copies count bytes with no sentinel and the walk continues into uninitialized kernel stack until it happens to hit a zero byte.

Sibling handler amdgpu_set_pp_od_clk_voltage (:543-606) copies count+1 bytes (includes the sentinel) and cannot exceed 63 tokens, so it does not have this bug — the delta proves the profile-mode loop is the defect.

Reproduce (guest, mechanism replica — guest has no AMD GPU)

./build.sh    # ships + builds amdgpu_parser_replica.ko
./run.sh      # kldload; sysctl kern.amdgparun=1  -> guest PANICS

The module runs the exact amdgpu_pm.c:946-957 walk (same 3-delimiter strsep set, same isspace skip) on the buffer printf '5 1 2 3' > … would deliver (count=7, i=1, copy = "1 2 3\0"). Expected serial console:

amdgparun: walking 6-byte content, last byte 0x00
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x0
Stopped at      run_parse.part.1+0xe0:  movzbl  (%rax),%edx
db>

Guest sits in DDB; reset with vm.sh reset with-src afterwards.

Fix

Bound parameter_size (< 64), NUL-terminate buf_cpy explicitly (buf_cpy[count-i] = '\0'), and guard the skip loop (while (tmp_str != NULL && isspace(*tmp_str))) — see fix.diff.

DF-4366 — VERDICT

Status: inconclusive (amdgpu sysfs entry hardware-gated on this guest; parse-loop mechanism reproduced deterministically via kernel-module replica that panics the guest). Confidence: certain. Severity: Low.

Root cause (source-certain)

amdgpu_set_pp_power_profile_mode() (sys/dev/drm/amd/amdgpu/amdgpu_pm.c:916, the store handler of the pp_power_profile_mode sysfs attribute registered at :1025-1027, S_IRUGO | S_IWUSR) parses CUSTOM-profile writes (profile_mode == PP_SMC_POWER_PROFILE_CUSTOM == 5, kgd_pp_interface.h:135) with:

• :944 memcpy(buf_cpy, buf, count-i); — buf_cpy[128], never explicitly NUL-terminated; count ≤ 127 is the only bound (:940-941);
• :948 strsep(&tmp_str, delimiter) with delimiter = {' ', '\n', '\0'} (:931);
• :955-956 while (isspace(*tmp_str)) tmp_str++; — executed immediately after strsep, with no NULL check.

DragonFly strsep (sys/libkern/strsep.c) returns the trailing token and sets *stringp = NULL when the remainder contains no delimiter. For a write whose last byte is not ' ' or '\n' — trivially produced with printf '%s' "5 1 2 3" > ...pp_power_profile_mode instead of echo — the final strsep matches the '\0' delimiter (copied in from the sysfs sentinel by the off-by-one count-i copy), sets tmp_str = NULL, and isspace(*tmp_str) (sys/sys/ctype.h:43 — plain comparisons on *tmp_str) dereferences address 0.

The numeric tail (parameter[], parameter_size) is bounded in practice: delimiters terminate inputs yield ≤ 63 tokens within count ≤ 127, and the 64-token unterminated shape NULL-panics before the parameter[parameter_size] store — so the stack OOB write is not reachable; the reachable defects are (a) the deterministic NULL deref and (b) the unterminated buf_cpy walk into uninitialized stack for i == 0 input shapes.

Guest reproduction (mechanism replica) — panic.txt, run.log

The guest has no AMD GPU (virtio-net/emulated VGA only), so the amdgpu sysfs entry cannot be exercised directly. The replica module (amdgpu_parser_replica.c) runs the verbatim delimiter walk (same strsep 3-delimiter set, same isspace skip, same copy shape count-i from the advanced pointer) on the exact byte sequence printf '5 1 2 3' > delivers. First and only attempt:

amdgparun: loaded (pp_power_profile_mode parser replica)
amdgparun: walking 6-byte content, last byte 0x00
Fatal user address access from kernel mode from sysctl at ffffffff82600150
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x0
fault code              = supervisor read data, page not present
Stopped at      run_parse.part.1+0xe0:  movzbl  (%rax),%edx
db>

Decisive: fault virtual address = 0x0, supervisor read data, and the faulting instruction is exactly the isspace(*tmp_str) byte load (movzbl (%rax),%edx with %rax == NULL). The guest died into DDB and was reset (vm.sh reset with-src).

Why Low severity

The attribute is S_IWUSR (root-writable only), so the direct impact is a root-triggerable kernel panic (DoS). It is filed because it is a deterministic, one-write kernel crash on a documented interface of the powerplay dispatch surface audited in this batch, and because the same loop shape is copy-pasted across the DRM tree.

Fix

fix.diff: explicitly NUL-terminate buf_cpy, bound parameter_size, and NULL-guard the skip loop (while (tmp_str != NULL && isspace(*tmp_str))). Driver-level validation impossible on this guest (no AMD GPU); the fix removes both the NULL deref and the uninitialized-stack walk by construction.

Guest left clean (vm.sh reset with-src after the panic capture).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.