DF-4641
radeon: radeon_read_platform_bios maps a fixed 256KB window from the PCI ROM BAR base regardless of the BAR's actual decode size - kernel reads physical memory beyond the device's ROM aperture into rdev->bios (and maps device MMIO write-back cached)
Summary
The DF-specific platform path maps the architectural 256KB maximum unconditionally - even when the ROM BAR decodes only 2-128KB (common) - and kmemdups up to 256KB from that mapping: everything past the real ROM is physical space the device does not own (adjacent MMIO/unclaimed holes), read into the parsed buffer with possible read side effects. Also WB-cached device MMIO (incorrect). No userspace dump interface, so bounded hardening on the firmware-trust boundary. Probe-BAR-size + uncacheable fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4641 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.3 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
probe-BAR-size + map_uncacheable + cap-kmemdup fix in finding markdown
per-fix-DF-4641
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
DF-specific function (absent from FreeBSD drm2): maps the architectural 256KB maximum regardless of the ROM BAR's actual decode (as little as 2KB per the vga_pci mask), and maps device MMIO WRITE-BACK cached instead of uncacheable. Sibling vga_pci path is rman-bounded. Low, hardware-gated.
Verdict
not_run: needs a radeon GPU with a sub-256KB ROM BAR; guest has none
No comments yet.