Integer overflow in skl_wm_method1/skl_wm_method2 watermark calculation via downscale-adjusted pixel rate
Summary
skl_wm_method1 at intel_pm.c:4481 declares uint32_t wm_intermediate_val then :4487 computes wm_intermediate_val = latency * pixel_rate * cpp (all uint32 -> 32-bit multiply wraps). skl_wm_method2 at :4507 same pattern latency * pixel_rate. pixel_rate is wp->plane_pixel_rate set via skl_adjusted_plane_pixel_rate = mul_round_up_u32_fixed16(cstate->pixel_rate, downscale_amount) with downscale up to 9x for sprite planes (3x per direction per skl_max_scale). Example overflow: pixel_rate=300000, downscale=9x -> plane_pixel_rate=2700000; latency=277 (max pcode 255 + WA additions); cpp=8: 277*2700000*8 = 5,983,200,000 > UINT32_MAX. Produces watermark far too small -> display FIFO underrun / visual corruption / display engine hang requiring GPU reset. Contrast intel_wm_method1 (:664) and mul_round_up_u32_fixed16 which correctly use uint64. Requires Intel SKL+ (gen9) with sprite-plane scaling. Local DRM master user trigger.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1118 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source-confirmation verdict for DF-1118 | 638 B | ↓ raw |
| fix.diff | suggested-fix | Widen wm_intermediate_val to uint64_t to prevent integer overflow | 419 B | view raw |
| ../fix_build.log | build-log | Batch kernel build log (all fixes, rc=0) | 5.6 MB | ↓ download |
DF-1118 Verification Verdict
Severity: Low Impact class: overflow Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)
Verdict: REPRODUCED (source-confirmed)
The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.
Fix: Widen wm_intermediate_val to uint64_t to prevent integer overflow
Fix applied and validated in batch kernel build (rc=0, -Werror).
Fix validation
All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build.
Build result: rc=0, 0 errors (full -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): skl_wm_method1 computes wm_intermediate_val = latency * pixel_rate * cpp in uint32_t with no overflow check; large modes silently wrap, producing bogus watermark values -> GP
Verified recommended fix
REPRODUCED (source-only): skl_wm_method1 computes wm_intermediate_val = latency * pixel_rate * cpp in uint32_t with no overflow check; large modes silently wrap, producing bogus watermark values -> GPU hang.
Verdict
REPRODUCED (source-only): skl_wm_method1 computes wm_intermediate_val = latency * pixel_rate * cpp in uint32_t with no overflow check; large modes silently wrap, producing bogus watermark values -> GPU hang.
No comments yet.