DF-5225
amdgpu_vf_error: signed int ring counters used as modulo array indices β 2^31 wrap is signed-overflow UB and produces negative array-index writes (contained inside amdgpu_vf_error_buffer)
Summary
read_count/write_count are signed int (amdgpu_virt.h:44-45) used as %16 subscripts (vf_error.c:42-46,76): after 2^31 puts the increment overflows (UB) and negative remainder writes code[index]/flags[index]/data[index] at [-15,-1] - mis-writes stay inside the embedding struct (worst case lk_flags/lk_wmesg of the live lockmgr). Reaching wrap needs 2^31 genuine SR-IOV VF failure events (months); both fns no-op outside VF mode; amdgpu module-only. uint32_t counter fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5225 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5225
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace: amdgpu_virt.h:44-45 signed counters as %16 subscripts at vf_error.c:42-46,76
Verified recommended fix
type counters uint32_t in amdgpu_virt.h
Verdict
untested (Info hardening; SR-IOV VF hardware-gated, module-only)
No comments yet.