⬢ DragonFlyBSD Kernel Audit
DF-3613 / harness.c
← back to finding ↓ download raw 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
/*
 * DF-3613 — integer divide-by-zero from zero PLL reference clock
 * (radeon si_dpm.c:4811 / 4927).  Same malicious-VBIOS DoS family as
 * DF-1137/DF-3612, distinct sink.
 *
 * radeon_atom_get_clock_info() (radeon_atombios.c:1188-1193 / 1215-1220)
 * stores the FirmwareInfo reference clocks with no zero fallback
 * (unlike pll_out_min, which gets a 27000/64800/20000 default at :1202):
 *
 *   radeon_atombios.c:1188  if (ASIC_IS_DCE4(rdev))                 [SI is DCE6]
 *   radeon_atombios.c:1189      spll->reference_freq = le16(info_21.usCoreReferenceClock);
 *   radeon_atombios.c:1216      mpll->reference_freq = le16(info_21.usMemoryReferenceClock);
 *
 * si_dpm.c then divides by them unconditionally:
 *
 *   si_calculate_sclk_params (every engine-clock programming):
 *     si_dpm.c:4798   u32 reference_clock = rdev->clock.spll.reference_freq;
 *     si_dpm.c:4810   tmp = (u64)engine_clock * reference_divider * post_div * 16384;
 *     si_dpm.c:4811   do_div(tmp, reference_clock);        // div by 0 -> #DE
 *
 *   si_populate_mclk_value (every memory-clock programming):
 *     si_dpm.c:4920   u32 reference_clock = rdev->clock.mpll.reference_freq;
 *     si_dpm.c:4927   tmp = freq_nom / reference_clock;    // div by 0 -> #DE
 *
 * si_calculate_sclk_params is called for every performance level of every
 * power state (si_populate_sclk_value <- si_convert_power_level_to_smc)
 * and 256 times from si_init_smc_spll_table — i.e. always, during
 * si_dpm_enable, on the very first level.
 *
 * Harness: [A] executes the exact 64-bit division with reference_freq==0
 * (SIGFPE == kernel #DE panic).  [B] runs the guarded variant from fix.diff.
 */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
#include <stdint.h>

static volatile uint64_t sink;

/* si_dpm.c:4784-4812 verbatim structure */
static void si_calculate_sclk_params(uint32_t engine_clock, uint32_t reference_clock,
				     uint32_t ref_div, uint32_t post_div)
{
	uint64_t tmp;
	uint32_t fbdiv, reference_divider = 1 + ref_div;

	tmp = (uint64_t)engine_clock * reference_divider * post_div * 16384;
	tmp = tmp / reference_clock;			/* do_div(tmp, reference_clock) :4811 */
	fbdiv = (uint32_t)tmp;
	sink = fbdiv;
	printf("    UNREACHABLE: division by zero survived (fbdiv=%u)\n", fbdiv);
}

/* si_dpm.c:4916-4928 verbatim structure */
static void si_populate_mclk_value(uint32_t memory_clock, uint32_t reference_clock)
{
	uint32_t freq_nom = memory_clock * 2;
	uint64_t tmp = freq_nom / reference_clock;	/* :4927 */
	sink = tmp * tmp;
	printf("    UNREACHABLE: division by zero survived\n");
}

/* fix.diff variant */
static int si_calculate_sclk_params_fixed(uint32_t engine_clock, uint32_t reference_clock,
					  uint32_t ref_div, uint32_t post_div)
{
	uint64_t tmp;
	uint32_t fbdiv, reference_divider = 1 + ref_div;

	if (reference_clock == 0)			/* fix.diff guard */
		return -1;
	tmp = (uint64_t)engine_clock * reference_divider * post_div * 16384;
	tmp = tmp / reference_clock;
	fbdiv = (uint32_t)tmp;
	sink = fbdiv;
	return 0;
}

static void report(int st)
{
	if (WIFSIGNALED(st))
		printf("    child died from SIGFPE (signal %d): 64-bit divide by zero\n"
		       "    >>> In kernel: do_div by 0 -> #DE fault -> panic on first level\n"
		       "        upload during si_dpm_enable <<<\n",
		       WTERMSIG(st));
	else
		printf("    child exited %d (NOT expected)\n", WEXITSTATUS(st));
}

int main(void)
{
	pid_t p;
	int st = 0;

	printf("== DF-3613 harness: crafted VBIOS FirmwareInfo with usCoreReferenceClock/usMemoryReferenceClock == 0 ==\n\n");
	printf("radeon_atombios.c:1189/1216: reference_freq = le16(vbios)  [no zero fallback]\n\n");

	printf("[A1] si_dpm.c:4811 do_div(tmp, spll.reference_freq==0)\n");
	fflush(stdout);
	p = fork();
	if (p == 0) { si_calculate_sclk_params(94000, 0, 1, 1); _exit(0); }
	waitpid(p, &st, 0); report(st);

	printf("\n[A2] si_dpm.c:4927 freq_nom / (mpll.reference_freq==0)\n");
	fflush(stdout);
	p = fork();
	if (p == 0) { si_populate_mclk_value(150000, 0); _exit(0); }
	waitpid(p, &st, 0); report(st);

	printf("\n[B] Fixed path (fix.diff: `if (reference_clock == 0) return -EINVAL;`)\n");
	int rc = si_calculate_sclk_params_fixed(94000, 0, 1, 1);
	printf("    ref=0  -> rc=%d (level upload refused, no trap)\n", rc);
	rc = si_calculate_sclk_params_fixed(94000, 27000, 1, 1);
	printf("    ref=27000 -> rc=0, fbdiv=%llu (normal programming)\n", (unsigned long long)sink);
	return 0;
}