⬢ DragonFlyBSD Kernel Audit
DF-4290 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c
@@ -1245,15 +1245,24 @@ static int asic_internal_ss_get_ss_asignment(struct pp_hwmgr *hwmgr,
 	if (entry_found) {
 		ssEntry->speed_spectrum_percentage =
 			le16_to_cpu(ssInfo->usSpreadSpectrumPercentage);
 		ssEntry->speed_spectrum_rate = le16_to_cpu(ssInfo->usSpreadRateInKhz);
 
 		if (((GET_DATA_TABLE_MAJOR_REVISION(table) == 2) &&
 			(GET_DATA_TABLE_MINOR_REVISION(table) >= 2)) ||
 			(GET_DATA_TABLE_MAJOR_REVISION(table) == 3)) {
 			ssEntry->speed_spectrum_rate /= 100;
 		}
+
+		/*
+		 * Security: a zero (or truncated-to-zero) spread rate is
+		 * used as a divisor by every consumer (ci/iceland/fiji/...
+		 * smumgr clock-spread setup); returning success with
+		 * rate == 0 causes a kernel divide-by-zero panic.
+		 */
+		if (ssEntry->speed_spectrum_rate == 0) {
+			pr_err("Invalid VBIOS spread-spectrum rate (0 kHz)\n");
+			memset(ssEntry, 0, sizeof(*ssEntry));
+			return 1;
+		}
 
 		switch (ssInfo->ucSpreadSpectrumMode) {