DF-4545 — vega20 pptable init reports SUCCESS with NULL OD arrays → NULL-deref panic at driver load

Severity: Medium (crafted-VBIOS deterministic kernel panic) | Confidence: certain File: sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:823,835-846,870-877,880-891

What

Two independent gaps leave hwmgr->pptable->od_feature_capabilities / od_settings_max / od_settings_min NULL while vega20_pp_tables_initialize() returns 0 (success):

1. The revision gate (:823): the three OD copies run only when OverDrive8Table.ucODTableRevision == 1. Any other legal value (0, 2, 3, ...) skips them entirely — no error, arrays stay NULL. The PowerSaving clock copies (:864-878) have the same shape.
2. Ignored return codes (CWE-252): the five copy calls (:835-846, :870-877) drop -ENOMEM on the floor, so an allocation failure also yields NULL arrays with a "successful" init.

vega20_pp_tables_initialize (hwmgr.c:222) runs before backend_init (hwmgr.c:229); vega20_hwmgr_backend_init → vega20_enable_dpm_tasks → vega20_od8_initialize_default_settings (vega20_hwmgr.c:1598) → vega20_od8_set_feature_capabilities, whose first array access (vega20_hwmgr.c:906, od_feature_capabilities[0] with GNLD_DPM_GFXCLK enabled on real silicon) dereferences NULL → kernel panic during amdgpu driver load. The fill loop (:1219) would deref NULL likewise.

Same untrusted-firmware threat model as knowns DF-1689/DF-1690 but a different defect class (NULL deref / skipped-init-reported-as-success vs OOB read of the blob). Note also :857 reads ODSettingsMax[ATOM_VEGA20_ODSETTING_POWERPERCENTAGE] unconditionally even when the revision gate skipped parsing — garbage TDPODLimit can set the PowerControl cap.

Reproduce (lifted-copy harness)

./build.sh && ./run.sh

Expected (run.log): - CONTROL rev=1 healthy alloc → init SUCCESS, consumer completes, no fault - VARIANT A crafted ucODTableRevision=2 → check_powerplay_tables PASSES (format rev 11, structuresize>0, smcPPTable.Version=3), init returns 0 with od_feature_capabilities=0x0, consumer faults: SIGSEGV at address 0x0 — panic-class - VARIANT B rev=1 + injected kzalloc failure (the ignored -ENOMEM) → same fault at 0x0 - PATCHED (fix.diff: checked returns + refuse-to-succeed-with-NULL) → init returns -EINVAL, consumer never runs, no fault

Fix validation

• fix.diff — git apply --check OK; return codes checked + NULL guard that fails init with -EINVAL
• full amdgpu.ko rebuild with the patch under the real kernel toolchain (-Werror): RC=0 (fix_build.log); guest /usr/src restored
• harness PATCHED control: crafted rev=2 refused at init, no fault

Files

• od_null_deref.c (sha256 97242d7d577fb00d2cc1ea71b6a54a0758c8caa2a5df42f3b659601a1fac0739)
• build.sh / run.sh, build.log / run.log / run.2.log / fix_run.log
• fix.diff, fix_build.log, env.txt, VERDICT.md, manifest.json, verdict.json

VERDICT — DF-4545

Reproduced: YES (lifted-copy harness on the audit guest; in-kernel path hardware-gated)

• Root cause proven (vega20_processpptables.c):
• :823 — the ucODTableRevision == 1 gate around ALL three OD copies; revision != 1 skips them silently.
• :835-846 / :870-877 — the five copy-helper return codes are dropped (CWE-252); a -ENOMEM leaves the pointers NULL.
• :889-891 — init returns result of append_vbios_pptable (0), so vega20_pp_tables_initialize reports SUCCESS with NULL od arrays.
• Consumer proven (vega20_hwmgr.c): backend_init (hwmgr.c:229, after pptable_init at :222) → vega20_enable_dpm_tasks → vega20_od8_initialize_default_settings (:1598) → vega20_od8_set_feature_capabilities — first deref od_feature_capabilities[ ATOM_VEGA20_ODFEATURE_GFXCLK_LIMITS] at :906, guarded only by smu_features[GNLD_DPM_GFXCLK].enabled (true on functioning silicon). No NULL check anywhere on the path (checked :906-:976 and :1216-1221).
• Harness result (run.log): VARIANT A (crafted ucODTableRevision=2, all header checks pass, Version=3) → init SUCCESS with od_feature_capabilities=0x0 → consumer SIGSEGV at 0x0 — the kernel-equivalent panic. VARIANT B (rev=1, injected kzalloc failure) → identical fault, proving the ignored -ENOMEM is equally fatal. CONTROL (rev=1 healthy) runs clean; PATCHED (fix.diff) refuses init (-EINVAL) and the consumer never runs.

Impact

Deterministic kernel panic (NULL-deref) at amdgpu driver load on a machine whose VBIOS carries an OverDrive8 revision other than 1 — a value the driver parses but never accepts, reporting success instead of rejecting the table. Same crafted-firmware precondition as DF-1689/DF-1690 (Medium per family convention); also a memory-pressure-induced variant. DoS only — NULL write at a fixed offset 0, no controllable data.

Fix validation

• git apply --check OK
• Full amdgpu.ko rebuild with the fix under the real kernel toolchain with -Werror: RC=0 (fix_build.log); /usr/src restored + verified
• Harness PATCHED control: crafted table rejected at init, no fault

Kernel refs

sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:823, sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:835, sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:839, sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:843, sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:870, sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:874, sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:889, sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:906, sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:1598, sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:222, sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:229

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.