⬢ DragonFlyBSD Kernel Audit
DF-3869 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-3869",
  "title": "Zero-divisor (#DE panic) in dce_calcs calculate_bandwidth line 839 (and u32 div at 1945) from degenerate user modes",
  "verdict": "inconclusive (hardware-gated); arithmetic reproduced exactly on guest",
  "impact": "dos (kernel panic)",
  "reproduce": {
    "build": "cc -O2 -o dce839_zero_div dce839_zero_div.c",
    "run": "./dce839_zero_div",
    "expected": "[6] DIVISOR == 0 CONFIRMED; [7]/[9] children die SIGFPE (#DE analog)"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:839",
    "sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:1945",
    "sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:1939",
    "sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:57",
    "sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:69",
    "sys/dev/drm/amd/display/dc/inc/bw_fixed.h:121",
    "sys/dev/drm/amd/display/dc/os_types.h:76",
    "sys/dev/drm/include/linux/math64.h:76",
    "sys/dev/drm/drm_modes.c:1103"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "dce839_zero_div.c", "build.sh", "run.sh",
    "run.log", "run.1.log", "fix.diff", "manifest.json", "verdict.json"
  ]
}