DF-4524
vce_v3_0: VCE bo is sized exactly AMDGPU_VCE_FIRMWARE_OFFSET (256) bytes short — instance-1 DATA window extends past the end of vcpu_bo
Summary
sw_init sizes vcpu_bo at FW+2*(STACK+DATA) but mc_resume lays the cache windows out starting at the 256-byte firmware offset, so the instance-1 DATA region ends exactly 256 bytes beyond the bo's extent. If the fw ever writes the tail of its shared scratch, it corrupts the adjacent VRAM object (possibly another process's). Speculative impact (fw-defined), certain arithmetic, upstream-inherited, VRAM-only. Add-the-offset fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4524 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: no AMD GPU on guest
fix in finding markdown
per-fix-DF-4524
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
bo sized FW+2*(STACK+DATA) but mc_resume lays regions out after a 256-byte head offset - instance-1 DATA ends exactly 256 bytes past the bo. Add-the-offset-to-the-size fix.
Verdict
not_run: no Fiji/Polaris/CZ hardware on guest; upstream-inherited, VRAM-only
No comments yet.