DF-4370 — amdgpu placement-array overflow + BUG_ON panic from GEM_CREATE domain mask

• File: sys/dev/drm/amd/amdgpu/amdgpu_object.c (:139-209, walk), amdgpu_object.h:35 (AMDGPU_BO_MAX_PLACEMENTS 3), reached from amdgpu_gem.c:233,260 and amdgpu_gem.c:716-730
• Severity: Medium (unprivileged local kernel panic / DoS on amdgpu systems; 12-36 byte constant OOB write inside the amdgpu_bo allocation preceding the panic)
• Class: CWE-787 / CWE-129 (write past array bound inside heap object) + CWE-757 (BUG() reachable from unprivileged ioctl)

Build & run (guest)

cc -O2 -o /tmp/poc_df4370 /tmp/poc_df4370.c     # build.sh
/tmp/poc_df4370                                  # run.sh  (unprivileged user)

Expected on a vulnerable amdgpu machine: * driver amdgpu v... then the FIRST AMDGPU_IOC_GEM_CREATE (domains=0x7) never returns — the console shows panic: BUG in amdgpu_bo_placement_from_domain at amdgpu_object.c:209.

Expected on this audit VM (no GPU): NO_DRM_DEVICES, exit 2 (observed).

Trigger summary

1. AMDGPU_GEM_CREATE with in.domains = VRAM|GTT|CPU (0x7) → amdgpu_bo_placement_from_domain() appends 3 entries (in-bounds) and then BUG_ON(c >= 3) fires with c==3 → panic.
2. in.domains = 0x3f (all six domains; mask accepted at amdgpu_gem.c:233) → the walk writes places[3..5] — past the 3-element array, over bo->placement and the head of bo->tbo — before the same BUG_ON panics.
3. Secondary path: AMDGPU_GEM_OP SET_PLACEMENT with value 0x7 sets bo->preferred_domains = 0x7 (amdgpu_gem.c:727); the next CS/eviction amdgpu_bo_validate() → same walk → same panic.

Artifacts

• poc_df4370.c — self-contained trigger (no DRM headers required)
• build.log, run.log, env.txt — guest evidence
• fix.diff — bound the walk (if (c < AMDGPU_BO_MAX_PLACEMENTS) guards + BUG_ON(c > ...)), applies cleanly with patch -p1
• VERDICT.md — full analysis

DF-4370 VERDICT — amdgpu placement walk overflow / BUG_ON panic

Bottom line

Certain by static proof; not reproduced at runtime because the audit VM has no GPU (no /dev/dri, only QEMU virtio VGA). The PoC builds and runs on the guest and exits NO_DRM_DEVICES (2). On any machine with an amdgpu device node, the first GEM_CREATE with domains=0x7 provably panics the kernel.

Reproduction status

Status: not_reproduced — target device absent (impact none on this guest). Real-world impact: unprivileged kernel panic (local DoS) on any system exposing an amdgpu render/card node, plus a deterministic 12-36 byte constant-data write past placements[3] inside the same heap object before the panic.

The bug, line by line

1. sys/dev/drm/amd/amdgpu/amdgpu_object.h:35 #define AMDGPU_BO_MAX_PLACEMENTS 3 and :81 struct ttm_place placements[3]; inside struct amdgpu_bo.

2. sys/dev/drm/amd/amdgpu/amdgpu_object.c:131-216 amdgpu_bo_placement_from_domain(abo, domain) appends one placement per set domain bit among VRAM/GTT/CPU/GDS/GWS/OA (up to 6), writing places[c].fpfn/.lpfn/.flags first and checking the bound after:

c if (domain & AMDGPU_GEM_DOMAIN_OA) { places[c].fpfn = 0; /* <-- write happens here */ places[c].lpfn = 0; places[c].flags = TTM_PL_FLAG_UNCACHED | AMDGPU_PL_FLAG_OA; c++; } ... BUG_ON(c >= AMDGPU_BO_MAX_PLACEMENTS); /* amdgpu_object.c:209 */

• c == 3 (e.g. VRAM|GTT|CPU): three in-bounds writes, then BUG_ON(3 >= 3) is TRUE → panic("BUG in ...") (sys/dev/drm/include/asm/bug.h:33-39: BUG/BUG_ON = unconditional panic() in this port).
• c >= 4 (any GDS/GWS/OA bit mixed with ≥1 standard domain): places[3] (and [4], [5]) are stored past the end of the 3-element array before the BUG_ON fires.

3. struct amdgpu_bo layout (amdgpu_object.h:77-108), 64-bit: preferred_domains@0, allowed_domains@4, placements@8..43, struct ttm_placement placement@48 (num_placement@48, placement ptr@56, num_busy_placement@64, busy_placement ptr@72), struct ttm_buffer_object tbo@80. So the OOB stores for c=6 scribble: * places[3] (GDS) → placement.num_placement = 0 * places[4] (GWS) → placement.placement = NULL, num_busy_placement = TTM_PL_FLAG_UNCACHED|AMDGPU_PL_FLAG_GWS * places[5] (OA) → busy_placement = (flags << 32) non-canonical garbage All values are constants; all land inside the same kzalloc'd struct amdgpu_bo (no cross-object heap corruption), and BUG_ON panics immediately after, so the write is never dereferenced. Practical impact = the panic; the OOB write is the memory-corruption component that makes this more than a logic bug (and would become directly dangerous if BUG() were ever compiled out).

4. Reachability (unprivileged, no capabilities needed): * amdgpu_kms.c:1197 — AMDGPU_GEM_CREATE is registered DRM_AUTH|DRM_RENDER_ALLOW → reachable from any render node. * amdgpu_gem.c:233 — domains only validated against AMDGPU_GEM_DOMAIN_MASK = 0x3f (all six bits accepted). * amdgpu_gem.c:260-262 → amdgpu_gem_object_create → amdgpu_bo_create (amdgpu_object.c:586) → amdgpu_bo_do_create (amdgpu_object.c:419) → amdgpu_bo_placement_from_domain(bo, bp->domain) at amdgpu_object.c:493 — before any TTM allocation, i.e. the bug fires on the first ioctl, regardless of memory pressure. * Size checks pass trivially: amdgpu_bo_validate_size (amdgpu_object.c:382-417) passes when GTT is in the mask and the size is small (for 0x3f, size <<= PAGE_SHIFT at :435-437 first — 4 bytes → 16 KiB — still far below gart size). * Secondary path: amdgpu_gem_op_ioctl SET_PLACEMENT (amdgpu_gem.c:716-732) sets robj->preferred_domains = value & (VRAM|GTT|CPU) with no ≤2-domain constraint; any later amdgpu_bo_validate() (amdgpu_object.c:674-694, driven by CS validation amdgpu_cs.c:393,514 or eviction) re-runs the walk on bo->preferred_domains == 7 → same panic.

5. Why c==3 is enough: the guard is >= not >. c==3 writes only indices 0..2 (legal), yet asserts. So even the reasonable request "VRAM|GTT|CPU" (a normal "anywhere" allocation) panics. VRAM|GTT (c=2) — the combination Mesa actually uses — is unaffected, which is why this survived in the wild: no mainstream client sends ≥3 domain bits.

Exploitability toward uid=0

Not viable: the OOB write targets a fixed offset with constant data inside the object's own allocation, and BUG_ON is an unconditional panic() (sys/dev/drm/include/asm/bug.h:33-37) in this tree — execution never resumes after the corruption. Ceiling = reliable local DoS (C:N/I:N/A:H).

Fix validation

fix.diff (guard every store with if (c < AMDGPU_BO_MAX_PLACEMENTS), assert c > MAX instead of >=) was generated mechanically and verified with patch -p1 --dry-run against a pristine copy — APPLIES_CLEAN (scratch copy only; sys/ untouched). Runtime fix validation is impossible on this VM (no amdgpu kernel path to patch into a testable state), hence fix_status: not_testable. Post-fix semantics: a 0x3f request keeps the first three placements (VRAM, GTT, CPU) and silently drops the on-chip pools; a 0x7 request succeeds normally instead of panicking.

kernel_refs

• sys/dev/drm/amd/amdgpu/amdgpu_object.c:139-216 (walk + BUG_ON at :209)
• sys/dev/drm/amd/amdgpu/amdgpu_object.c:493 (call site in do_create)
• sys/dev/drm/amd/amdgpu/amdgpu_object.h:35,77-108 (MAX=3, struct layout)
• sys/dev/drm/amd/amdgpu/amdgpu_gem.c:233,260 (mask + pass-through)
• sys/dev/drm/amd/amdgpu/amdgpu_gem.c:716-732 (SET_PLACEMENT secondary path)
• sys/dev/drm/amd/amdgpu/amdgpu_kms.c:1197 (DRM_RENDER_ALLOW)
• sys/dev/drm/include/asm/bug.h:33-39 (BUG_ON = panic, unconditional)
• sys/dev/drm/include/drm/ttm/ttm_placement.h:85-89 (ttm_place, 12 bytes)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

DF-4370 fix

amdgpu_bo_placement_from_domain() can be driven by any unprivileged render-node client (AMDGPU_GEM_CREATE domains, or AMDGPU_GEM_OP SET_PLACEMENT + a CS that validates the BO) to append more placement entries than abo->placements[AMDGPU_BO_MAX_PLACEMENTS == 3] can hold, and the BUG_ON(c >= AMDGPU_BO_MAX_PLACEMENTS) fires even for the legal in-bounds case c == 3 (VRAM|GTT|CPU).

Fix (behavior-preserving except for dropping entries that previously panicked the kernel):

1. guard every store with if (c < AMDGPU_BO_MAX_PLACEMENTS) so the walk can never write past placements[2], and
2. change the assertion to BUG_ON(c > AMDGPU_BO_MAX_PLACEMENTS) so a full (3-entry) placement set is accepted instead of panicking.

Apply with: (cd /usr/src && patch -p1) < fix.diff (against the read-only audit tree: git apply fix.diff)