DF-4903 — Uninitialised heap read in k8_powernow_setperf() tail leaks one heap word into world-readable sysctl

File: sys/dev/powermng/powernow/powernow.c Severity: Medium · Bucket: kernleak · Confidence: likely (code path certain; hardware precondition)

Root cause (path:line)

1. k8_get_curfreq() (powernow.c:204-224) returns -1 ("Not reached", powernow.c:222-223) when the CPU's current fid/vid (MSR 0xc0010042) is not among the decoded PST states — e.g. a BIOS PST that does not list the boot state, a state changed after boot by other means, or a trimmed OEM table.
2. powernow_init() (powernow.c:392) calls k8_powernow_setperf(k8_get_curfreq()). The callee takes unsigned int freq (powernow.c:227): -1 becomes 0xFFFFFFFF.
3. The state-match loop (powernow.c:245-251) compares state_table[i].freq >= freq with freq unsigned — no MHz value can match UINT_MAX, so the loop runs to completion: i == cstate->n_states, fid == vid == 0.
4. The transitions then drive the CPU toward fid 0 / vid 0 (a valid K8 state: 800 MHz), and the tail at powernow.c:310-311 fires: cpuspeed = cstate->state_table[i].freq; with i == n_states.
5. struct k8pnow_cpu_state is allocated with kmalloc(..., M_DEVBUF, M_WAITOK) (powernow.c:366) — not zeroed — and k8pnow_decode_pst() (powernow.c:139-164) initialises only the first n_states of the 16 state_table[] entries. For n_states < 16 the read at step 4 therefore returns an uninitialised heap word (still inside the allocation). For n_states == 16 it reads the n_states member itself (benign value).
6. cpuspeed is handed to any local user via the world-readable sysctl machdep.powernow.frequency.current (SYSCTL_OUT at powernow.c:337, leaf registered at powernow.c:417-420, CTLFLAG_RD; DragonFly gates only sysctl writes on privilege — kern/kern_sysctl.c:1446).

Net effect: one 4-byte kernel-heap disclosure per load/trigger, readable by an unprivileged user. Distinct from known DF-1960 (no-matching-PST ⇒ whole-table uninit): here the PST decode succeeded, but the -1 sentinel walks the index past the initialised prefix.

Trigger preconditions

• AMD K8 (PowerNow!/Cool'n'Quiet, CPUID 0x80000007 EDX bit 6) — the driver's gate at powernow.c:358-363.
• Boot (or current) fid/vid ∉ decoded PST states ⇒ k8_get_curfreq()==-1.
• n_states < 16 so state_table[n_states] is uninitialised heap.

What was run (see VERDICT.md)

• Guest is Intel/QEMU: kldload powernow prints module_register_init: MOD_LOAD (powernow) error 2 (CPUID gate) — the vulnerable path cannot execute on this guest, so no kernel-level reproduction was possible (status: untested).
• A userland logic harness (sim_tailread.c) replicating the exact struct layout and expressions was compiled and run as uid=1001 on the guest: confirms -1 → UINT_MAX → i==n_states → uninit read → cpuspeed == 0xA5A5A5A5. Logic-level proof only; not a kernel leak.

Build / run

cc -Wall -O2 -o sim_tailread sim_tailread.c && ./sim_tailread

Expected output

k8_get_curfreq() = -1   (boot cfid/cvid not in table)
cpuspeed after init = 0xa5a5a5a5 (-1515870811)
LEAK CONFIRMED (logic): ...

Recommended fix

Treat "no matching state" as an error instead of falling through the loop tail, and never feed -1 into the unsigned parameter — see fix.diff.

DF-4903 — VERDICT

status: untested · reproduced: 0 · impact: leak (kernel-heap info leak, 4 bytes, unpriv-readable sysctl) · confidence: likely

Narrative

Pass-2 audit of sys/dev/powermng/powernow/powernow.c found that the "current frequency" plumbing leaks an uninitialised kernel-heap word when the CPU's live fid/vid does not match any decoded PST entry:

• k8_get_curfreq() returns -1 on mismatch (powernow.c:223).
• powernow_init() passes that -1 straight into k8_powernow_setperf(unsigned int freq) (powernow.c:227, call at :392), where it becomes 0xFFFFFFFF.
• Every state_table[i].freq >= freq comparison (powernow.c:246) compares an int against that unsigned value — all false — so i exits the loop equal to n_states with fid=vid=0.
• The tail cpuspeed = cstate->state_table[i].freq; (powernow.c:310-311) then reads state_table[n_states]: for n_states < 16 that entry was never initialised (kmalloc without M_ZERO at powernow.c:366; decode fills only n_states entries, powernow.c:143-162).
• cpuspeed is world-readable at machdep.powernow.frequency.current (powernow.c:337, registered :417-420). DragonFly only restricts sysctl writes (kern_sysctl.c:1446), so any local user can read the leak.

Not DF-1960: DF-1960 is the "PSB present but no PST matches ⇒ whole table uninitialised" case. DF-4903 is a different root cause — the table is properly decoded; the -1 sentinel type-confuses the unsigned match loop and indexes one past the initialised prefix.

Verification attempts

1. Guest gate check — the audit guest is QEMU Virtual CPU version 2.5+ (Intel-class). kldload powernow → console: module_register_init: MOD_LOAD (powernow, ...) error 2 — the CPUID 0x80000007 gate (powernow.c:361-363) refuses the module, no sysctls are created, and no MSR/PSB code executes. Runtime reproduction of an AMD-K8-only path is impossible on this guest ⇒ honest untested (kernel side).
2. Logic harness (sim_tailread.c) — exact replica of the struct layout, the -1 sentinel, the unsigned comparison, and the tail read; heap poisoned with 0xA5 to emulate kmalloc(M_DEVBUF) reuse. Compiled with guest cc 8.3 [DragonFly] and run as uid=1001(maxx):

k8_get_curfreq() = -1 (boot cfid/cvid not in table) cpuspeed after init = 0xa5a5a5a5 (-1515870811) LEAK CONFIRMED (logic): uninitialised heap word read at state_table[n_states=3] landed in the world-readable sysctl machdep.powernow.frequency.current

This proves the code path and the type confusion concretely; it is a userland simulation and is not counted as a kernel reproduction.

Exploit chain

Passive 4-byte heap-info leak, once per module load (or per any future setperf caller passing an out-of-table frequency). Value is residual slab data from a prior M_DEVBUF allocation; not attacker-positioned reliably ⇒ info value limited; no escalation path from this primitive alone.

Fix validation

Not run — kernel path not executable on the Intel/QEMU guest (fix_status: not_testable). fix.diff is authored from line-accurate root-cause knowledge: bail out of k8_powernow_setperf() when the match loop ran off the end, and only call it from powernow_init() with a validated frequency.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.