⬢ DragonFlyBSD Kernel Audit
DF-3707 / trigger_notes.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
/*
 * DF-3707 trigger documentation (hardware-gated).
 * VBIOS recipe: single GFXCLK dependency entry with ulClk == 0 (and/or single MCLK entry 0).
 * setup_default_single_dpm_table appends entry 0 unconditionally (i==0 branch, :1209),
 * so golden_dpm_table.gfx_table.dpm_levels[0].value == 0, count == 1.
 * Then ANY local user:   cat /sys/class/drm/card0/device/pp_sclk_od
 *   -> amdgpu_get_pp_sclk_od (S_IRUGO, amdgpu_pm.c:1019) -> vega10_get_sclk_od :4540
 *   -> DIV_ROUND_UP(x*100, 0)  -> integer divide-by-zero trap -> kernel panic.
 * Userspace demo of the arithmetic (same DIV_ROUND_UP macro semantics):
 */
#include <stdio.h>
#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
int main(void)
{
	int value = 0, golden_value = 0;           /* crafted-VBIOS case */
	printf("golden_value=%d -> DIV_ROUND_UP(%d*100, %d) would execute %d/0\n",
	       golden_value, value, golden_value, value * 100 - 1);
	printf("kernel: #DE trap -> panic (kernel-side); userspace: SIGFPE\n");
	return 0;
}