/* * DF-4696 — trigger + arithmetic proof for divide-by-zero in * sys/dev/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c:439-441 * (dpp1_dscl_calc_lb_num_partitions). * * SINK (kernel, my audit file): * dcn10_dpp_dscl.c:411-412 line_size = min(viewport.width, recout.width) * dcn10_dpp_dscl.c:416 memory_line_size_y = (line_size*lb_bpc + 71)/72 * dcn10_dpp_dscl.c:439 *num_part_y = lb_memory_size / memory_line_size_y * ^^^^^^^^^^^^^^^^^^^^ 816 / 0 -> #DE -> panic * (also :440 via memory_line_size_c and :441 via memory_line_size_a, * same line_size root cause) * * PRODUCER CHAIN (shared with DF-4373, every link static, same types): * amdgpu_dm.c:2210-2240 fill_rects_from_plane_state: raw crtc_x/y/w/h * copied, only zero-size rejected, clip_rect=dst_rect * (plane rects NEVER clipped to the CRTC window). * amdgpu_dm.c:3585-3603 dm_plane_atomic_check: fill_rects + * dc_resource.c:2891-2900 dc_validate_plane: "validates pixel format only". * dc_resource.c:543 viewport.width = clip.w * src.w / dst.w (SOURCE px) * dc_resource.c:1125-1127 the ONLY degeneracy guard: viewport >= 16 — * recout is computed AFTER it, never guarded. * dc_resource.c:637-643 recout.width = clip.w * dst.w / src.w, then * clamped to the stream dst window; for a plane * flush off the right edge this yields EXACTLY 0. * dcn10_dpp.c:141-210 dpp_get_optimal_number_of_taps: computes * pixel_width = min(viewport.w, recout.w) at :148-151 * but NEVER USES IT — returns true unconditionally * (non-FP16) — the missing guard on DCN10. * validation: dcn10_validate_plane (dcn10_resource.c:1131-1138) checks * video src width only; validate_bandwidth never * looks at recout. Context validates DC_OK. * COMMIT: dcn10_hw_sequencer.c:2101-2104 update_dchubp_dpp (full_update) * -> :2029-2041 update_scaler * -> dpp1_dscl_set_scaler_manual_scale (dscl.c:647) * -> find_lb_memory_config (:463; use_max_lb=false, * dc kzalloc'd so dc->debug zeroed, dc.c:729-732) * -> caps->dscl_calc_lb_num_partitions (:476) * -> 816 / 0 => integer #DE in kernel mode. * * TRIGGER GEOMETRY (UABI-legal atomic commit, session DRM master): * CRTC/mode 640x480; plane buffer 640x480 (src 640 wide); * CRTC_X = 640 (== mode width: flush off the right edge), * CRTC_Y = 0, CRTC_W = 1, CRTC_H = 480; format XRGB8888 (not FP16, so the * DSCL_MODE_DSCL_BYPASS early-return at dscl.c:684-685 is not taken). * * This program: * 1. probes /dev/dri/card* (on the audit QEMU guest there is none: QEMU * std VGA only, no vendor 0x1002 PCI device — amdgpu DC cannot attach); * 2. replays the producer+sink arithmetic 1:1 with the kernel's integer * types (struct rect fields are signed int, dc_hw_types.h) and executes * the exact division sequence. The attack case dies with SIGFPE * (userland twin of kernel #DE/panic); the control case completes and * prints the clamped partition counts. */ #include #include #include #include #include #include #include /* mirror of struct rect (sys/dev/drm/amd/display/include/dc_hw_types.h) */ struct rect { int x, y, width, height; }; /* Faithful division executor. The kernel computes * lb_memory_size / memory_line_size_y (dcn10_dpp_dscl.c:439) * with a runtime-unknown divisor, which compiles to a real idiv and faults * with #DE when the divisor is 0. A naive userland replica with the same * constants lets the compiler exploit the C UB of x/0 and skip the fault, * so we hide the divisor behind an asm barrier: the compiler must emit the * actual divide instruction, making SIGFPE the exact userland twin of the * kernel's #DE. (Proof this matters: without the barrier, gcc8 computes * garbage and the process survives — observed and fixed during verification.) */ static int kdiv(int a, int b) { asm volatile("" : "+r"(b)); return a / b; } static int run_case(const char *name, int crtc_x, int expect_fault) { /* --- fill_rects_from_plane_state (amdgpu_dm.c:2210-2240) --- */ struct rect src_rect = { 0, 0, 640, 480 }; /* 640x480 buffer */ struct rect dst_rect = { crtc_x, 0, 1, 480 }; /* raw UABI crtc_* */ struct rect clip_rect = dst_rect; /* :2240 clip_rect = dst_rect */ /* stream state: mode 640x480, src window == dst window == full mode */ struct rect stream_src = { 0, 0, 640, 480 }; struct rect stream_dst = { 0, 0, 640, 480 }; /* --- calculate_viewport width (dc_resource.c:543): SOURCE pixels --- */ int viewport_w = clip_rect.width * src_rect.width / dst_rect.width; /* --- resource_build_scaling_params guard (dc_resource.c:1125-1127) --- */ if (viewport_w < 16) { printf("%s: viewport.width=%d < 16 -> build returns false " "(config REJECTED, no bug)\n", name, viewport_w); return 0; } /* --- calculate_recout (dc_resource.c:631-657) --- */ int recout_x = stream_dst.x; if (stream_src.x < clip_rect.x) recout_x += (clip_rect.x - stream_src.x) * stream_dst.width / stream_src.width; int recout_w = clip_rect.width * stream_dst.width / stream_src.width; if (recout_w + recout_x > stream_dst.x + stream_dst.width) recout_w = stream_dst.x + stream_dst.width - recout_x; /* --- dcn10_dpp.c:148-151: pixel_width computed, then IGNORED --- * (the dead variable is why validation never rejects this geometry) */ int pixel_width = viewport_w < recout_w ? viewport_w : recout_w; (void)pixel_width; /* kernel computes this and never reads it */ /* --- dpp1_dscl_calc_lb_num_partitions (dcn10_dpp_dscl.c:411-441) --- */ int lb_bpc = 10; /* LB_PIXEL_DEPTH_30BPP, forced by dcn10_hw_sequencer.c:2037 / dc_resource.c:1136 */ int line_size = viewport_w < recout_w ? viewport_w : recout_w; int memory_line_size_y = (line_size * lb_bpc + 71) / 72; /* +71 to ceil */ int memory_line_size_a = (line_size + 5) / 6; /* +5 to ceil */ int lb_memory_size = 816; /* LB_MEMORY_CONFIG_1, dscl.c:422 */ printf("%s: viewport.width=%d recout.x=%d recout.width=%d " "line_size=%d memory_line_size_y=%d memory_line_size_a=%d\n", name, viewport_w, recout_x, recout_w, line_size, memory_line_size_y, memory_line_size_a); if (memory_line_size_y == 0 || memory_line_size_a == 0) { printf("%s: divisor is 0 -> kernel would execute " "816 / 0 at dcn10_dpp_dscl.c:439 -> #DE -> panic. " "Executing userland twin; SIGFPE follows:\n", name); fflush(stdout); if (!expect_fault) abort(); } /* the exact division from dscl.c:439 (and :441) */ volatile int num_part_y = kdiv(lb_memory_size, memory_line_size_y); if (num_part_y > 64) num_part_y = 64; /* dscl.c:447-448 clamp */ printf("%s: no fault: num_part_y clamped to %d\n", name, num_part_y); return 0; } int main(int argc, char **argv) { const char *path = argc > 1 ? argv[1] : "/dev/dri/card0"; int fd = open(path, O_RDWR); printf("DF-4696 device probe: open(%s) = %d errno=%d (%s)\n", path, fd, errno, strerror(errno)); if (fd < 0) { printf(" -> no DRM device: the amdgpu DC path (which compiles\n" " dcn10_dpp_dscl.c into the amdgpu module) cannot\n" " attach on this guest; runtime trigger impossible.\n" " Proving the arithmetic chain instead.\n\n"); } else { close(fd); printf(" -> DRM device present: run the atomic commit described\n" " in the header comment (plane flush off right edge).\n" " NOT attempted automatically (needs fb/object setup).\n\n"); } /* control: plane fully on-screen -> normal path, no fault */ run_case("control (CRTC_X=0, fully visible)", 0, 0); /* attack: plane flush off the right edge of a 640-wide mode */ run_case("attack (CRTC_X=640, flush off right edge)", 640, 1); printf("attack case survived?? — unexpected, chain broken\n"); return 1; }