Missing divide-by-zero guard in hsw_ddi_calc_wrpll_link() (unlike cnl_calc_wrpll_link)
Summary
hsw_ddi_calc_wrpll_link() at intel_ddi.c:1298-1303: r=wrpll&WRPLL_DIVIDER_REF_MASK(0xff), p=wrpll&WRPLL_DIVIDER_POST_MASK(0x3f<<8). Both can be 0 per mask width. return (refclk*n*100)/(p*r) at :1303 with NO zero guard. Sibling cnl_calc_wrpll_link at :1424 correctly guards WARN_ON(p0==0||p1==0||p2==0). skl variant safe (switch maps to non-zero constants). Reachable via intel_ddi_get_config->intel_ddi_clock_get->hsw_ddi_clock_get on Haswell. Buggy BIOS WRPLL handoff with p=0 or r=0 -> #DE kernel panic. Fix: add if(WARN_ON(p==0||r==0)) return 0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1226 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 697 B | view raw |
DF-1226 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
Missing divide-by-zero guard in hsw_ddi_calc_wrpll_link() (unlike cnl_calc_wrpll_link)
Source Location
sys/dev/drm/i915/intel_ddi.c:1298-1303
Verdict
Source-confirmed: Missing divide-by-zero guard in hsw_ddi_calc_wrpll_link() (unlike cnl_. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
hsw_ddi_calc_wrpll_link() at intel_ddi.c:1298-1303: r=wrpll&WRPLL_DIVIDER_REF_MASK(0xff), p=wrpll&WRPLL_DIVIDER_POST_MASK(0x3f<<8). Both can be 0 per mask width. return (refclkn100)/(p*r) at :1303 with NO zero guard. Sibling cnl_calc_wrpll_link at :1424 correctly guards WARN_ON(p0==0||p1==0||p2==0). skl variant safe (switch maps to non-zero constants). Reachable via intel_ddi_get_config->intel_ddi_clock_get->hsw_ddi_clock_get on Haswell. Buggy BIOS WRPLL handoff with p=0 or r=0 -> #DE kernel p
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: hsw_ddi_calc_wrpll_link divides by (p*r) without zero guard; p,r extracted from wrpll bitmask can be 0. Added p==0||r==0 guard.
Verified recommended fix
Source-confirmed: hsw_ddi_calc_wrpll_link divides by (p*r) without zero guard; p,r extracted from wrpll bitmask can be 0. Added p==0||r==0 guard.
Verdict
Source-confirmed: hsw_ddi_calc_wrpll_link divides by (p*r) without zero guard; p,r extracted from wrpll bitmask can be 0. Added p==0||r==0 guard.
No comments yet.