[PATCH] dxgkrnl: Fix fatal kernel panic in dxgvmb_send_wait_sync_object_gpu() during module load (FORTIFY_SOURCE)

Nobody has claimed this yet.

Root Cause Analysis

The crash occurs during VMBus command buffer serialization. The driver assigns current_pos to command->fence_values and then increments the pointer past the field to write the objects array:

```c
current_pos = (u8 *) command->fence_values;
memcpy(current_pos, fences, fence_size);
current_pos += fence_size;
memcpy(current_pos, objects, object_size); // <-- CRASH POINT
```

Under modern GCC pointer provenance tracking, the compiler binds current_pos strictly to the bounds of the fence_values field. When advancing past it, __builtin_dynamic_object_size() evaluates the remaining space as 0 bytes. The runtime FORTIFY_SOURCE wrapper intercepts the subsequent memcpy(), classifies it as an illegal field-spanning buffer overflow, and immediately triggers a kernel panic.
Solution / Patch

We replace the vulnerable memcpy() with a switch statement that handles common 32-bit GPU sync object transactions (0 and 4 bytes) via direct pointer assignment. This completely bypasses the string fortify wrapper. For arbitrary payload sizes, an optimization barrier (asm volatile) is introduced to break AST provenance tracking before calling memcpy(), preventing false-positive kernel panics while preserving buffer integrity.

```text
[ 1.470786] misc dxg: dxgk: dxgkio_is_feature_enabled: Ioctl failed: -22
[ 1.474194] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -22
[ 1.474652] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -22
[ 1.475095] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -22
[ 1.475644] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 1.859149] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.041795] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.042328] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.042762] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.043218] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.043675] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.044137] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.044912] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.045457] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.045979] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.046446] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.046888] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.047404] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.048135] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.048702] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.049180] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.049765] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.198906] misc dxg: dxgk: dxgkio_query_adapter_info: Ioctl failed: -2
[ 2.236222] ------------[ cut here ]------------
[ 2.236685] memcpy: detected field-spanning write (size 4) of single field "current_pos" at drivers/hv/dxgkrnl/dxgvmbus.c:3095 (size 0)
[ 2.237358] WARNING: CPU: 4 PID: 228 at drivers/hv/dxgkrnl/dxgvmbus.c:3095 dxgvmb_send_wait_sync_object_gpu+0x271/0x290
[ 2.237908] Modules linked in: autofs4 br_netfilter bridge stp llc ip_tables tun
[ 2.238308] CPU: 4 UID: 1000 PID: 228 Comm: Xwayland Not tainted 6.18.35.2-microsoft-standard-WSL2 #1 PREEMPT(none)
[ 2.238818] RIP: 0010:dxgvmb_send_wait_sync_object_gpu+0x271/0x290
[ 2.239083] Code: a2 fe ff ff b8 ea ff ff ff eb 8d 31 c9 48 c7 c2 a8 51 a8 aa 4c 89 ee 48 c7 c7 d8 dd 9b aa c6 05 94 64 6a 01 01 e8 6f 95 25 ff <0f> 0b 4c 8b 85 60 ff ff ff e9 9f fe ff ff e8 9c e4 31 00 66 66 2e
[ 2.239956] RSP: 0018:ffffd1a9845afb48 EFLAGS: 00010286
[ 2.240198] RAX: 0000000000000000 RBX: ffffd1a984dc1038 RCX: 00000000000001d0
[ 2.240573] RDX: 0000000000000000 RSI: 00000000ffffdfff RDI: 0000000000000001
[ 2.240941] RBP: ffffd1a9845afc00 R08: 0000000000000000 R09: 0000000000000003
[ 2.241261] R10: ffffd1a9845af9b8 R11: ffffffffab553708 R12: 0000000000000001
[ 2.241612] R13: 0000000000000004 R14: 0000000000000008 R15: 0000000000000008
[ 2.241965] FS: 00007c45f98b9f40(0000) GS:ffff8a37cf4c6000(0000) knlGS:0000000000000000
[ 2.242305] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2.242600] CR2: 00007c45f708a150 CR3: 0000000132ab2000 CR4: 0000000000350ef0
[ 2.242959] Call Trace:
[ 2.243110]
[ 2.243242] dxgkio_submit_wait_to_hwqueue+0x133/0x2e0
[ 2.243523] dxgk_ioctl+0x66/0x110
[ 2.243692] dxgk_unlocked_ioctl+0x12/0x20
[ 2.243867] __x64_sys_ioctl+0xa1/0xf0
[ 2.244033] x64_sys_call+0x102c/0x20f0
[ 2.244185] do_syscall_64+0x73/0x990
[ 2.244344] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.244651] ? vfree.part.0+0xe9/0x290
[ 2.244865] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.245229] ? vfree+0x30/0x50
[ 2.245397] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.245721] ? dxgvmb_send_lock2+0x87/0x2a0
[ 2.245896] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.246093] ? __rseq_handle_notify_resume+0xaf/0x490
[ 2.246331] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.246577] ? dxgkio_lock2+0x11c/0x240
[ 2.246733] ? dxgk_ioctl+0x66/0x110
[ 2.246903] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.247158] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.247411] ? exit_to_user_mode_loop+0xc4/0x100
[ 2.247668] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.247958] ? do_syscall_64+0x28a/0x990
[ 2.248161] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.248370] ? do_syscall_64+0x28a/0x990
[ 2.248616] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.248892] ? irqentry_exit+0x3f/0x50
[ 2.249054] ? srso_alias_return_thunk+0x5/0xfbef5
[ 2.249285] ? exc_page_fault+0x7f/0x170
[ 2.249459] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 2.249666] RIP: 0033:0x7c45fa1e87aa
[ 2.249826] Code: f3 0f 1e fa 55 48 89 e5 48 8d 45 10 48 89 55 e0 48 89 45 c0 48 8d 45 d0 48 89 45 c8 b8 10 00 00 00 c7 45 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 0d 89 d0 5d c3 66 0f 1f 84 00 00 00 00 00
[ 2.250607] RSP: 002b:00007ffc44a1ac90 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 2.251055] RAX: ffffffffffffffda RBX: 00005ce10536f080 RCX: 00007c45fa1e87aa
[ 2.251461] RDX: 00007ffc44a1acb8 RSI: 00000000c0184736 RDI: 0000000000000006
[ 2.251800] RBP: 00007ffc44a1ac90 R08: 00005ce105090c48 R09: 00005ce10508dac0
[ 2.252164] R10: 0000000000000200 R11: 0000000000000246 R12: 0000000000000001
[ 2.252529] R13: 00005ce10536f080 R14: 00007c45f45a7080 R15: 00007ffc44a1aecc
[ 2.252865]
[ 2.252966] ---[ end trace 0000000000000000 ]---
```

```diff
diff --git a/drivers/hv/dxgkrnl/dxgvmbus.c b/drivers/hv/dxgkrnl/dxgvmbus.c
index 21e782e79..a05152044 100644
--- a/drivers/hv/dxgkrnl/dxgvmbus.c
+++ b/drivers/hv/dxgkrnl/dxgvmbus.c
@@ -3092,7 +3092,25 @@ int dxgvmb_send_wait_sync_object_gpu(struct dxgprocess *process,
current_pos = (u8 *) command->fence_values;
memcpy(current_pos, fences, fence_size);
current_pos += fence_size;
- memcpy(current_pos, objects, object_size);
+
+ /*
+ * Avoid FORTIFY_SOURCE "field-spanning write" panic under GCC 16.
+ * Breaking pointer provenance tracking via asm barrier and direct writes.
+ */
+ switch (object_size) {
+ case 0:
+ *(u32 *)current_pos = 0;
+ break;
+ case 4:
+ *(u32 *)current_pos = *(u32 *)objects;
+ break;
+ default: {
+ void *dest = current_pos;
+ asm volatile("" : "+r" (dest));
+ memcpy(dest, objects, object_size);
+ break;
+ }
+ }

if (dxgglobal->async_msg_enabled) {
command->hdr.async_msg = 1;

```

Start in drivers/hv/dxgkrnl/dxgvmbus.c at dxgvmb_send_wait_sync_object_gpu(), then inspect the FORTIFY_SOURCE trace and surrounding command-buffer layout. Build the WSL kernel with the affected compiler configuration and reproduce the sync-object submission. Done means the transaction no longer triggers the field-spanning warning or panic while preserving correct fence and object serialization.

Written by the indexing model from the issue text.