DF-4431
hubp1_program_tiling: log_2() of gfx9 tiling config uses ilog2, and ilog2(0)==-1 programs NUM_PIPES/NUM_BANKS/etc. to FIELD MAX (GPU-hang class, hw-config-gated)
Summary
The five log_2() calls on info->gfx9.* have no zero guard: ilog2 is fls(n)-1 so ilog2(0)=(unsigned)-1, which REG_UPDATE masks into DCSURF_ADDR_CONFIG as all-ones field values - the same failure shape as the in-file pitch underflow (DF-1613's comment: maxed pitch field 'can cause system hang'). Values are kernel-read from the GPU (gb_addr_config_fields), so the trigger is a misbehaving/collapsing PCIe device, not userspace. Low/hardening. Clamp-before-REG_UPDATE fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4431 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1011 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: hardware-gated
fix.diff in finding markdown
per-fix-DF-4431
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Low/hardening; values kernel-read from GPU not userspace-set; trigger is device fault/reset class. Clamp-before-REG_UPDATE fix in finding markdown.
Verdict
not_run: DCN1 GPU absent from guest (bochs only); arithmetic source-proven (ilog2(0)=fls(0)-1=-1 -> masked field max)
No comments yet.