⬢ DragonFlyBSD Kernel Audit
DF-1274 / trigger.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
/*
 * DF-1274 trigger (latent / not live-reproducible on audit guest)
 *
 * tonga spread-spectrum clock math divides by VBIOS-supplied
 * ss_info.speed_spectrum_rate without a zero check:
 *
 *   tonga_calculate_sclk_params @ tonga_smumgr.c:591
 *     clkS = reference_clock * 5 / (reference_divider * ss_info.speed_spectrum_rate);
 *   tonga_calculate_mclk_params @ tonga_smumgr.c:883
 *     clks = reference_clock * 5 / ss_info.speed_spectrum_rate;
 *
 * speed_spectrum_rate is loaded directly from VBIOS usSpreadRateInKhz
 * (ppatomctrl.c:1248) with no zero guard. reference_divider = 1 +
 * uc_pll_ref_div so it is >=1, leaving ss_info.speed_spectrum_rate the
 * sole zero divisor. A crafted VBIOS with usSpreadRateInKhz==0 =>
 * integer divide-by-zero (#DE) => fatal trap/panic at powerplay init.
 *
 * Sibling: DF-1204 (ni_dpm ss.rate) same class, fixed the same way.
 *
 * Reachability REQUIRES a Tonga/Fiji/Polaris AMD GPU (amdgpu powerplay).
 * No such HW on the audit guest => not live-reproducible. See VERDICT.md.
 */

int main(void) { return 0; }