DF-4854 — vega10_ih: unvalidated device-DMA'd IH wptr → permanent interrupt-thread spin + 20-byte OOB ring read on overflow recovery

Twin of DF-4843 (tonga_ih), filed for sys/dev/drm/amd/amdgpu/vega10_ih.c (pass 2, GLM 5.3). One aggravator the tonga twin does not have: on Vega10 the 32-byte-entry decode at the top of the 256 KiB ring reads past the end of the DMA allocation when the device sets RB_OVERFLOW with a high wptr.

Where (all citations into the audit tree)

• sys/dev/drm/amd/amdgpu/vega10_ih.c:194-220 — vega10_ih_get_wptr()
• wptr read from device-DMA'd memory: ih.ring[ih.wptr_offs] (use_bus_addr=true is set at vega10_ih.c:389 amdgpu_ih_ring_init(adev, &adev->irq.ih, 256*1024, true))
• RB_OVERFLOW (bit 0, IH_RB_WPTR__RB_OVERFLOW_MASK 0x1, sys/dev/drm/amd/include/asic_reg/oss/osssys_4_0_sh_mask.h:229) is handled at :203-218, recovery rptr = (wptr + 32) & ptr_mask at :210-213
• return is wptr & ptr_mask at :219 — alignment (mod 32) never validated
• sys/dev/drm/amd/amdgpu/amdgpu_ih.c:154-157 — the walk: while (ih->rptr != wptr) { callback(); ih->rptr &= ih->ptr_mask; }
• rptr advances strictly in 32-byte steps (vega10_ih.c:308 prescreen ignore-path, vega10_ih.c:352 decode)
• sys/dev/drm/amd/amdgpu/amdgpu_ih.c:61-68 — the allocation: dma_alloc_coherent(ring_size + 8) = 0x40008 bytes; the +8 tail holds the wptr/rptr shadow words (indices 0x10000/0x10001)
• sys/dev/drm/amd/amdgpu/vega10_ih.c:327-334 — decode_iv reads ring[ring_index + 0 .. +7]
• sys/dev/drm/amd/amdgpu/amdgpu_irq.c:159-176 — callback also hands &ih->ring[ring_index] (32 bytes) to amdgpu_amdkfd_interrupt() at :170

Primitive 1 — permanent interrupt-thread spin (DoS)

rptr starts at 0 and only ever advances by 32 (then masked). If the device writes a wptr that is not a multiple of 32 (e.g. 0x10004), rptr != wptr holds for every iteration: rptr laps the 256 KiB ring forever inside amdgpu_irq_handler with ih->lock held (amdgpu_ih.c:144, atomic_xchg; it is only reset at :160 after loop exit). Every subsequent amdgpu interrupt hits the held lock and returns IRQ_NONE — all GPU interrupt delivery is dead, one CPU pegged. Same argument as DF-4843 with a 32-byte grid instead of 16.

Primitive 2 — 20-byte OOB read past the ring allocation

Overflow-recovery rptr keeps the (4-granular, IH_RB_WPTR__OFFSET_MASK 0x0003FFFC, sh_mask.h:230) phase of the device wptr. Pick wptr = 0x3FFDC with RB_OVERFLOW set: rptr := (0x3FFDC + 0x20) & 0x3FFFF = 0x3FFFC. First decode then uses ring_index = 0x3FFFC >> 2 = 0xFFFF and reads words 0xFFFF..0x10006 (vega10_ih.c:327-334), i.e. byte offsets 0x3FFFC..0x4001B. The allocation ends at 0x40008, so words 0x10002..0x10006 (byte range 0x40008..0x4001B, 20 bytes) are read out of bounds of the dma_alloc_coherent block. The OOB dwords become entry->src_data[] / timestamp / pasid fields and are dispatched (amdgpu_irq.c:170,173-175); dispatch indices are bounds-checked downstream (amdgpu_irq.c:409-417), so the OOB content is consumed/logged in-kernel (not directly returned to userspace — kfd pass-through at amdgpu_irq.c:170 receives the same OOB window).

Threat model

Hostile / faulting GPU (the DF-4755/4756 mxgpu model) or a desynced writeback: the wptr shadow is plain device-writable DMA memory. Upstream-inherited shape (upstream vega10_ih_get_wptr also only masks). No userspace-only trigger.

Reproduce / verify

Not runnable on the audit guest: it has no Vega10 (or any) AMD GPU, and the wptr source is device DMA. The trigger sketch (trigger_sketch.c) documents the required hostile-device writes. Static proof above is exact arithmetic on the register definitions; see VERDICT.md.

Recommended fix

Validate entry alignment in vega10_ih_get_wptr (round a misaligned wptr down to the 32-byte grid with a warn, and mask the overflow-recovery rptr the same way), and cap the per-invocation entry count in amdgpu_ih_process.

DF-4854 VERDICT — vega10_ih unvalidated wptr (DF-4843 twin) + overflow-recovery OOB read

Status: untested (hardware-bound — no AMD GPU on the audit guest). Confidence: certain (static proof, exact register arithmetic).

Why untested

The primitive requires the GPU's IH block to write a malformed wptr into the DMA'd writeback slot (ih.ring[ih.wptr_offs], vega10_ih.c:199). The QEMU audit guest (DragonFly dfbsd 6.5-DEVELOPMENT #0 ... X86_64_GENERIC) has no AMD GPU; there is no unprivileged-software path that forges the wptr. Same disposition as the tonga twin DF-4843 (untested / dos / certain).

Static proof

1. Ring geometry — vega10_ih.c:389: amdgpu_ih_ring_init(..., 256*1024, true) → amdgpu_ih.c:47-50: rb_bufsz = order_base_2(0x40000/4) = 16, ring_size = (1<<16)*4 = 0x40000, ptr_mask = 0x3FFFF; amdgpu_ih.c:61-68: dma_alloc_coherent(0x40000 + 8), wptr_offs = 0x10000, rptr_offs = 0x10001 (the +8 tail).

2. wptr source is device DMA — the writeback address programmed into mmIH_RB_WPTR_ADDR_LO/HI (vega10_ih.c:127-132) is rb_dma_addr + wptr_offs*4 = the first shadow word; HW (or a hostile GPU) writes it. vega10_ih.c:198-201 reads it back; :219 returns wptr & 0x3FFFF with no 32-byte alignment validation.

3. Spin — amdgpu_ih.c:154-157: rptr is 0-phase (init amdgpu_ih.c:51, steps +32 at vega10_ih.c:308/:352). wptr ≡ k (mod 32), k ≠ 0 ⇒ loop never terminates; ih->lock (amdgpu_ih.c:144) never released ⇒ every later interrupt returns IRQ_NONE at the atomic_xchg ⇒ GPU interrupt delivery dead + 1 CPU spinning. (Matches DF-4843 with a 32-byte grid.)

4. OOB read — register layout (osssys_4_0_sh_mask.h:225-231): RB_OVERFLOW = bit 0, OFFSET = bits [17:2] (4-byte granular). Overflow path vega10_ih.c:203-213 clears bit 0 then sets rptr = (wptr+32) & 0x3FFFF. Device picks wptr = 0x3FFDC | 1 ⇒ rptr = 0x3FFFC ⇒ first vega10_ih_decode_iv (vega10_ih.c:324-334) uses ring_index = 0xFFFF and reads words 0xFFFF..0x10006 = bytes 0x3FFFC..0x4001B; words 0x10002..0x10006 lie past the 0x40008-byte allocation ⇒ 20-byte OOB read. amdgpu_irq_callback additionally passes &ring[0xFFFF] to amdgpu_amdkfd_interrupt (amdgpu_irq.c:170) — same window. Downstream dispatch indexes are bounds-checked (amdgpu_irq.c:409-417), so impact is kernel-consumed OOB data (log fields / IV decode), not a demonstrated userspace leak.

Exploit chain

None (device-gated). Ceiling: hostile-GPU DoS (primitive 1) + hostile-GPU OOB read of ≤20 bytes of adjacent coherent DMA memory interpreted as an IV (primitive 2).

Kill list for the rest of the file (pass-2 negative evidence)

• dispatch client_id/src_id bounds-checked: amdgpu_irq.c:409-417
• normal-path decode is exactly in-bounds: max phase-0 rptr = 0x3FFE0 ⇒ words 0xFFF8..0xFFFF — inside the ring; only the overflow path breaks it
• ring-init wb/doorbell math correct (amdgpu_ih.c:61-68, vega10_ih.c:127-148); AMDGPU_DOORBELL64_IH << 1 is upstream parity (amdgpu.h:457)
• prescreen #if 0 kfifo stub (vega10_ih.c:288-301): the kprintf half is DF-1936 (known); the functional half (all retry faults dropped, per-VM fault hash never drained — amdgpu_vm_add_fault capped at 128, amdgpu_vm.c:3561, freed only at amdgpu_vm_fini:3308; fault_credit only ever decremented, amdgpu_vm.c:3390) is an upstream-divergence robustness issue with no memory-safety consequence — negative note, not a finding
• stale wptr shadow across disable/enable (vega10_ih.c:69-74 clears HW registers, not the DMA'd shadow): upstream-parity, subsumed by the unvalidated-wptr finding under the hostile-GPU model
• fini ordering correct: amdgpu_irq_fini (drm_irq_uninstall/free_irq) before amdgpu_ih_ring_fini (vega10_ih.c:405-406)

Fix

fix.diff intentionally omitted per policy for untested findings (same as DF-4843). Recommended shape: in vega10_ih_get_wptr, after masking, round a misaligned wptr down to the 32-byte entry boundary with a dev_warn (and apply the same alignment mask to the overflow-recovery rptr); cap the per-invocation entry count in amdgpu_ih_process so a bad wptr/storm cannot hard-spin the interrupt thread.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)