β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5225

amdgpu_vf_error: signed int ring counters used as modulo array indices β€” 2^31 wrap is signed-overflow UB and produces negative array-index writes (contained inside amdgpu_vf_error_buffer)

Summary

read_count/write_count are signed int (amdgpu_virt.h:44-45) used as %16 subscripts (vf_error.c:42-46,76): after 2^31 puts the increment overflows (UB) and negative remainder writes code[index]/flags[index]/data[index] at [-15,-1] - mis-writes stay inside the embedding struct (worst case lk_flags/lk_wmesg of the live lockmgr). Reaching wrap needs 2^31 genuine SR-IOV VF failure events (months); both fns no-op outside VF mode; amdgpu module-only. uint32_t counter fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5225 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.0 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5225

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace: amdgpu_virt.h:44-45 signed counters as %16 subscripts at vf_error.c:42-46,76

Verified recommended fix

type counters uint32_t in amdgpu_virt.h

Verdict

untested (Info hardening; SR-IOV VF hardware-gated, module-only)