DF-5234
u32-domain shift truncation: PF_LFB_SIZE<<24 wraps before assignment to u64 node_segment_size, silently mis-placing XGMI VRAM/GART apertures
Summary
REG_GET_FIELD is pure u32 arithmetic so the <<24 evaluates in the u32 domain before the u64 assignment: any PF_LFB_SIZE >= 0x100 (>=4GB carveout, 16-bit field) wraps mod 2^32 - 256GB segment stores 0, 4.25GB stores 16MB - and gmc_v9_0_vram_gtt_location computes per-node VRAM/GART bases from it, mis-placing apertures on a Vega20 XGMI hive. No attacker path: firmware-programmed register, VEGA20-gated, single-GPU skips the block entirely. (u64) cast one-liner fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5234 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5234
Confirmed kernel references
Detail
Evidence (decisive lines)
arithmetic proof from macro types (amdgpu.h:1154-1155) in finding markdown
Verified recommended fix
(u64) cast on the shifted REG_GET_FIELD value
Verdict
untested (Info; firmware-triggered, VEGA20 XGMI multi-GPU only)
No comments yet.