β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5234

u32-domain shift truncation: PF_LFB_SIZE<<24 wraps before assignment to u64 node_segment_size, silently mis-placing XGMI VRAM/GART apertures

Summary

REG_GET_FIELD is pure u32 arithmetic so the <<24 evaluates in the u32 domain before the u64 assignment: any PF_LFB_SIZE >= 0x100 (>=4GB carveout, 16-bit field) wraps mod 2^32 - 256GB segment stores 0, 4.25GB stores 16MB - and gmc_v9_0_vram_gtt_location computes per-node VRAM/GART bases from it, mis-placing apertures on a Vega20 XGMI hive. No attacker path: firmware-programmed register, VEGA20-gated, single-GPU skips the block entirely. (u64) cast one-liner fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5234 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.0 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5234

Confirmed kernel references

Detail

Evidence (decisive lines)

arithmetic proof from macro types (amdgpu.h:1154-1155) in finding markdown

Verified recommended fix

(u64) cast on the shifted REG_GET_FIELD value

Verdict

untested (Info; firmware-triggered, VEGA20 XGMI multi-GPU only)