DF-4912 — stats module: latent OOB write in mod_stats_update_event on length == 0, in code that is not compiled into any kernel build

File: sys/dev/drm/amd/display/modules/stats/stats.c:316-321 Severity: Info | CWE-787 (latent) / dead code | confidence: certain

Two facts, both proven without hardware

1. The module is dead code. sys/dev/drm/amd/amdgpu/Makefile:49-51 builds display/modules/{freesync,color,info_packet} — not modules/stats. No file in sys/ references modules/stats or calls any mod_stats_* function (repo-wide rg — zero hits outside the module itself and its header). The object is never compiled, never linked, never callable.

2. Latent defect. If the module were ever wired up: c copy_length = length; /* stats.c:316 */ if (length > MOD_STATS_EVENT_STRING_MAX) copy_length = MOD_STATS_EVENT_STRING_MAX; memcpy(&events[index].event_string, event_string, copy_length); events[index].event_string[copy_length - 1] = '\0'; /* :321 */ With length == 0 this executes event_string[-1] = '\0' — a one-byte write before the 512-byte array, i.e. into the high byte of entry_id (offset 3 of struct stats_event_cache, little-endian) — CWE-787 off-by-one. The very next statement (events[index].entry_id = core_stats->entry_id;, :323) rewrites that exact word, so the corruption is self-clobbering; net effect on the struct is zero. No caller exists to pass 0 today.

Build / run (semantic demonstration of the off-by-one only)

./build.sh   # cc -o stats_len0_demo stats_len0_demo.c
./run.sh     # standalone extraction of the exact kernel logic; shows the
             # write lands at buffer[-1] and is then overwritten

The demo proves the index arithmetic; it does NOT execute kernel code (none exists in the build).

Recommendation

Delete sys/dev/drm/amd/display/modules/stats/ (matches upstream direction — the module was never wired into the amdgpu driver), or — if it is kept for future wiring — apply fix.diff (guard length == 0 / clamp to MOD_STATS_EVENT_STRING_MAX - 1).

VERDICT — DF-4912

status: untested — deliberately: the vulnerable code is not part of any kernel build, so there is no kernel artifact to test. reproduced: 0 (kernel path) / semantic off-by-one demonstrated in userspace (run.log). impact: none (dead code + self-clobbering write). Severity Info.

Fact 1 — the module is dead code (certain)

• sys/dev/drm/amd/amdgpu/Makefile:49-51 compiles display/modules/freesync, display/modules/color, display/modules/info_packet — stats is absent (confirmed both in the audit tree and in the guest's /usr/src, run.log).
• Repo-wide search (rg -rn "modules/stats" sys/ and rg mod_stats_*): zero hits outside modules/stats/stats.c itself and modules/inc/mod_stats.h. No allocation, no call, no linkage. sys/conf/files has no stats entry.

Fact 2 — latent off-by-one OOB write (certain, demonstrated)

mod_stats_update_event (stats.c:296-326):

copy_length = length;                                  /* :316 */
if (length > MOD_STATS_EVENT_STRING_MAX)               /* :317 */
    copy_length = MOD_STATS_EVENT_STRING_MAX;
memcpy(&events[index].event_string, event_string, copy_length);
events[index].event_string[copy_length - 1] = '\0';    /* :321 — OOB at [-1] when length==0 */

length == 0 → copy_length - 1 wraps to 0xFFFFFFFF (unsigned) → the compiler itself proves it: building the exact clone with gcc 8.3 on the guest emits warning: array subscript 4294967295 is above array bounds of 'char[512]' [-Warray-bounds] (run.log). At runtime the write lands at event_string[-1] = offset 3 of struct stats_event_cache = the MSB of entry_id on little-endian — and stats.c:323 then assigns entry_id wholesale, clobbering the OOB byte. Net memory effect: zero. No caller exists to pass length == 0 regardless.

Other stats.c candidates checked and killed

• mod_stats_reset_data (:283-287): memset(core_stats->time, 0, sizeof * 0) when disabled — memset(NULL, 0, 0), benign in the kernel; entries/event bounds in all four update functions are correctly guarded (:310, :340, :385, :433); v_sync_time_in_us[num_vsyncs] bounded by the < MOD_STATS_NUM_VSYNCS check (:392); time[index - 1] safe because index starts at 1 (:166); concurrent update threads can at worst double-increment the index past entries but every write is re-guarded, so no OOB; mod_stats_dump guards both array walks (:235, :239).
• kcalloc(entries ≤ 0x01000000, ~120B) ≈ 2 GB max on crafted persistent data — allocation failure is handled (:148, :156), and dm_read_persistent_data has no live backing store for this key on DF.

Fix

Delete the module (matches upstream direction; it was never wired into the amdgpu driver) or apply fix.diff (guard length == 0, clamp to MOD_STATS_EVENT_STRING_MAX - 1).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.